# tcld namespace command reference > Namespace operations The `tcld namespace` command namespace operations. Alias: `n` - [tcld namespace create](#create) - [tcld namespace add-region](#add-region) - [tcld namespace delete-region](#delete-region) - [tcld namespace lifecycle](#lifecycle) - [tcld namespace delete](#delete) - [tcld namespace list](#list) - [tcld namespace get](#get) - [tcld namespace accepted-client-ca](#accepted-client-ca) - [tcld namespace auth-method](#auth-method) - [tcld namespace certificate-filters](#certificate-filters) - [tcld namespace update-codec-server](#update-codec-server) - [tcld namespace retention](#retention) - [tcld namespace search-attributes](#search-attributes) - [tcld namespace failover](#failover) - [tcld namespace update-high-availability](#update-high-availability) - [tcld namespace tags](#tags) - [tcld namespace capacity](#capacity) - [tcld namespace export](#export) - [tcld namespace set-connectivity-rules](#set-connectivity-rules) ### create The `tcld namespace create` command create a temporal namespace. Alias: `c` #### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` #### --ca-certificate The base64 encoded ca certificate Alias: `c` #### --namespace The namespace hosted on temporal cloud Alias: `n` #### --region Create namespace in specified regions; if multiple regions are selected, the first one will be the active region. See 'tcld account list-regions' to get a list of available regions for your account Alias: `re` #### --retention-days The retention of the namespace in days Alias: `rd` #### --auth-method The authentication method to use for the namespace (e.g. 'mtls', 'api_key') #### --ca-certificate-file The path to the ca pem file Alias: `cf` #### --certificate-filter-file Path to a JSON file that defines the certificate filters that will be added to the namespace. Sample JSON: { "filters": [ { "commonName": "test1" } ] } Alias: `cff` #### --certificate-filter-input JSON that defines the certificate filters that will be added to the namespace. Sample JSON: { "filters": [ { "commonName": "test1" } ] } Alias: `cfi` #### --search-attribute Flag can be used multiple times; value must be "name=type"; valid types are: [Keyword Text Int Double Datetime Bool KeywordList] Alias: `sa` #### --user-namespace-permission Flag can be used multiple times; value must be "email=permission"; valid permissions are: [Admin Write Read] Alias: `p` #### --enable-delete-protection Enable delete protection on the namespace Alias: `edp` #### --endpoint The codec server endpoint to decode payloads for all users interacting with this Namespace, must be https Alias: `e` #### --pass-access-token Pass the user access token to the remote endpoint Alias: `pat` #### --include-credentials Include cross-origin credentials Alias: `ic` #### --cloud-provider Cloud provider for the namespace to be created for, currently support [aws, gcp]. For this version, if not specified, we default to aws Alias: `cp` #### --tag Add tags to the namespace (format: key=value). Flag can be used multiple times. Alias: `t` #### --connectivity-rule-ids The list of connectivity rule IDs, can be used in create namespace and update namespace. example: --ids id1 --ids id2 --ids id3 Alias: `ids` ### add-region The `tcld namespace add-region` command add a new region to a namespace. #### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` #### --namespace The namespace hosted on temporal cloud Alias: `n` #### --region New region to add to the namespace. Alias: `re` #### --cloud-provider The cloud provider of the region. Default: aws ### delete-region The `tcld namespace delete-region` command delete a region from a namespace. #### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` #### --namespace The namespace hosted on temporal cloud Alias: `n` #### --region The region to remove from a namespace. Alias: `re` #### --cloud-provider The cloud provider of the region. Default: aws ### lifecycle The `tcld namespace lifecycle` command enable delete protection on a temporal namespace. Alias: `lc` - [tcld namespace lifecycle get](#get) - [tcld namespace lifecycle set](#set) #### get The `tcld namespace lifecycle get` command get the lifecycle spec for the namespace. ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --namespace The namespace hosted on temporal cloud Alias: `n` #### set The `tcld namespace lifecycle set` command set the lifecycle spec for the namespace. ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --enable-delete-protection Enable delete protection on the namespace, value must be true or false Alias: `edp` ### delete The `tcld namespace delete` command delete a temporal namespace. Alias: `d` #### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` #### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` #### --namespace The namespace hosted on temporal cloud Alias: `n` ### list The `tcld namespace list` command list all known namespaces. Alias: `l` #### --page-token The page token for list operations #### --page-size Number of namespaces to list per page ### get The `tcld namespace get` command get namespace information. Alias: `g` #### --namespace The namespace hosted on temporal cloud Alias: `n` ### accepted-client-ca The `tcld namespace accepted-client-ca` command manage client ca certificate used to verify client connections. Alias: `ca` - [tcld namespace accepted-client-ca list](#list) - [tcld namespace accepted-client-ca add](#add) - [tcld namespace accepted-client-ca remove](#remove) - [tcld namespace accepted-client-ca set](#set) #### list The `tcld namespace accepted-client-ca list` command list the accepted client ca certificates currently configured for the namespace. Alias: `l` ##### --namespace The namespace hosted on temporal cloud Alias: `n` #### add The `tcld namespace accepted-client-ca add` command add a new ca accepted client ca certificate. Alias: `a` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --ca-certificate The base64 encoded ca certificate Alias: `c` ##### --ca-certificate-file The path to the ca pem file Alias: `f` #### remove The `tcld namespace accepted-client-ca remove` command remove existing certificates. Alias: `r` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --ca-certificate The base64 encoded ca certificate Alias: `c` ##### --ca-certificate-file The path to the ca pem file Alias: `f` ##### --ca-certificate-fingerprint The fingerprint of to the ca certificate Alias: `fp` ##### --all If set, all existing certificates will be removed #### set The `tcld namespace accepted-client-ca set` command set the accepted client ca certificate. Alias: `s` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --ca-certificate The base64 encoded ca certificate Alias: `c` ##### --ca-certificate-file The path to the ca pem file Alias: `f` ### auth-method The `tcld namespace auth-method` command manage the authentication method for the namespace. Alias: `am` - [tcld namespace auth-method set](#set) - [tcld namespace auth-method get](#get) #### set The `tcld namespace auth-method set` command set the authentication method for the namespace. ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --auth-method The authentication method used for the namespace (i.e. 'restricted', 'mtls', 'api_key', 'api_key_or_mtls') Alias: `am` #### get The `tcld namespace auth-method get` command retrieve the authentication method for namespace. ##### --namespace The namespace hosted on temporal cloud Alias: `n` ### certificate-filters The `tcld namespace certificate-filters` command manage optional certificate filters used by namespace to authorize client certificates based on distinguished name fields. Alias: `cf` - [tcld namespace certificate-filters import](#import) - [tcld namespace certificate-filters export](#export) - [tcld namespace certificate-filters clear](#clear) - [tcld namespace certificate-filters add](#add) #### import The `tcld namespace certificate-filters import` command sets the certificate filters on the namespace. Existing filters will be replaced. Alias: `imp` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --certificate-filter-file Path to a JSON file that defines the certificate filters that will be configured on the namespace. This will replace the existing filter configuration. Sample JSON: { "filters": [ { "commonName": "test1" } ] } Alias: `file`, `f` ##### --certificate-filter-input JSON that defines the certificate filters that will be configured on the namespace. This will replace the existing filter configuration. Sample JSON: { "filters": [ { "commonName": "test1" } ] } Alias: `input`, `i` #### export The `tcld namespace certificate-filters export` command exports existing certificate filters on the namespace. Alias: `exp` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --certificate-filter-file Path to a JSON file where tcld will export the certificate filter configuration to Alias: `file`, `f` #### clear The `tcld namespace certificate-filters clear` command clears all certificate filters on the namespace. Note that this will allow *any* client certificate that chains up to a configured CA in the bundle to connect to the namespace. Alias: `c` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` #### add The `tcld namespace certificate-filters add` command adds additional certificate filters to the namespace. Alias: `a` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --certificate-filter-file Path to a JSON file that defines the certificate filters that will be added to the namespace. Sample JSON: { "filters": [ { "commonName": "test1" } ] } Alias: `file`, `f` ##### --certificate-filter-input JSON that defines the certificate filters that will be added to the namespace. Sample JSON: { "filters": [ { "commonName": "test1" } ] } Alias: `input`, `i` ### update-codec-server The `tcld namespace update-codec-server` command update codec server config used to decode encoded payloads through remote endpoint. Alias: `ucs` #### --namespace The namespace hosted on temporal cloud Alias: `n` #### --endpoint The codec server endpoint to decode payloads for all users interacting with this Namespace, must be https Alias: `e` #### --pass-access-token Pass the user access token to the remote endpoint Alias: `pat` #### --include-credentials Include cross-origin credentials Alias: `ic` ### retention The `tcld namespace retention` command manages configuration of the length of time (in days) a closed workflow will be preserved before deletion. Alias: `r` - [tcld namespace retention set](#set) - [tcld namespace retention get](#get) #### set The `tcld namespace retention set` command set the length of time (in days) a closed workflow will be preserved before deletion for a given namespace. Alias: `s` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --retention-days The retention of the namespace in days Alias: `rd` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` #### get The `tcld namespace retention get` command retrieve the length of time (in days) a closed workflow will be preserved before deletion for a given namespace. Alias: `g` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ### search-attributes The `tcld namespace search-attributes` command manage search attributes used by namespace. Alias: `sa` - [tcld namespace search-attributes add](#add) - [tcld namespace search-attributes remove](#remove) - [tcld namespace search-attributes rename](#rename) #### add The `tcld namespace search-attributes add` command add a new namespace custom search attribute. Alias: `a` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --search-attribute Flag can be used multiple times; value must be "name=type"; valid types are: [Keyword Text Int Double Datetime Bool KeywordList] Alias: `sa` #### remove The `tcld namespace search-attributes remove` command remove an existing namespace custom search attribute. Alias: `rm` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --search-attribute The name of the search attribute to remove Alias: `sa` #### rename The `tcld namespace search-attributes rename` command update the name of an existing custom search attribute. Alias: `rn` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### --existing-name The name of an existing search attribute Alias: `en` ##### --new-name The new name for the search attribute Alias: `nn` ### failover The `tcld namespace failover` command failover a temporal namespace. Alias: `fo` #### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` #### --namespace The namespace hosted on temporal cloud Alias: `n` #### --region The region to failover to Alias: `re` #### --cloud-provider The cloud provider of the region. Default: aws ### update-high-availability The `tcld namespace update-high-availability` command update Temporal namespace high availability setting. Alias: `uha` #### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` #### --namespace The namespace hosted on temporal cloud Alias: `n` #### --disable-auto-failover Disable Temporal-managed failover on a replicated namespace (use --disable-auto-failover=false to enable) ### tags The `tcld namespace tags` command manage namespace tags. Alias: `t` - [tcld namespace tags upsert](#upsert) - [tcld namespace tags remove](#remove) #### upsert The `tcld namespace tags upsert` command add new tags or update existing tag values. Alias: `u` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --tag Add new or update existing namespace tags (format: key=value). Flag can be used multiple times. Alias: `t` #### remove The `tcld namespace tags remove` command remove existing tags by key. Alias: `rm` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --tag-key Remove namespace tags by key. Flag can be used multiple times. Alias: `tk` ### capacity The `tcld namespace capacity` command manage namespace capacity. Alias: `cap` - [tcld namespace capacity get](#get) - [tcld namespace capacity update](#update) #### get The `tcld namespace capacity get` command get namespace capacity information. Alias: `g` ##### --namespace The namespace hosted on temporal cloud Alias: `n` #### update The `tcld namespace capacity update` command set the capacity of a given namespace. Alias: `u` ##### --namespace The namespace hosted on temporal cloud Alias: `n` ##### --capacity-mode The capacity mode to use for the namespace. Valid values are 'on_demand' and 'provisioned' Alias: `cm` ##### --capacity-value The capacity value to use for the namespace. Required if capacity mode is 'provisioned', ignored otherwise Alias: `cv` ##### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ### export The `tcld namespace export` command manage export. Alias: `es` - [tcld namespace export s3](#s3) - [tcld namespace export gcs](#gcs) #### s3 The `tcld namespace export s3` command manage S3 export sink. - [tcld namespace export s3 create](#create) - [tcld namespace export s3 validate](#validate) - [tcld namespace export s3 update](#update) - [tcld namespace export s3 get](#get) - [tcld namespace export s3 delete](#delete) - [tcld namespace export s3 list](#list) ##### create The `tcld namespace export s3 create` command create export sink. Alias: `c` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --sink-name Provide a name for the sink ###### --role-arn Provide role arn for the IAM Role ###### --s3-bucket-name Provide the name of an AWS S3 bucket that Temporal will send closed workflow histories to ###### --kms-arn Provide the ARN of the KMS key to use for encryption. Note: If the KMS ARN needs to be added or updated, user must create the IAM Role with KMS or modify the created IAM Role accordingly. ###### --region The region to use for the request, if not set the server will use the namespace's region Alias: `re` ##### validate The `tcld namespace export s3 validate` command validate export sink. Alias: `v` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --sink-name Provide a name for the sink ###### --role-arn Provide role arn for the IAM Role ###### --s3-bucket-name Provide the name of an AWS S3 bucket that Temporal will send closed workflow histories to ###### --kms-arn Provide the ARN of the KMS key to use for encryption. Note: If the KMS ARN needs to be added or updated, user must create the IAM Role with KMS or modify the created IAM Role accordingly. ###### --region The region to use for the request, if not set the server will use the namespace's region Alias: `re` ##### update The `tcld namespace export s3 update` command update export sink. Alias: `u` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --sink-name Provide a name for the sink ###### --enabled Whether the sink is enabled ###### --role-arn Provide role arn for the IAM Role ###### --s3-bucket-name Provide the name of an AWS S3 bucket that Temporal will send closed workflow histories to ###### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ###### --kms-arn Provide the ARN of the KMS key to use for encryption. Note: If the KMS ARN needs to be added or updated, user must create the IAM Role with KMS or modify the created IAM Role accordingly. ##### get The `tcld namespace export s3 get` command get export sink. Alias: `g` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --sink-name Provide a name for the sink ##### delete The `tcld namespace export s3 delete` command delete export sink. Alias: `d` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --sink-name Provide a name for the sink ###### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ###### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### list The `tcld namespace export s3 list` command list export sinks. Alias: `l` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --page-size The page size for list operations ###### --page-token The page token for list operations #### gcs The `tcld namespace export gcs` command manage GCS export sink. - [tcld namespace export gcs create](#create) - [tcld namespace export gcs update](#update) - [tcld namespace export gcs validate](#validate) - [tcld namespace export gcs get](#get) - [tcld namespace export gcs delete](#delete) - [tcld namespace export gcs list](#list) ##### create The `tcld namespace export gcs create` command create export sink. Alias: `c` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --sink-name Provide a name for the sink ###### --service-account-email Service account that has access to the sink ###### --gcs-bucket GCS bucket of the sink ##### update The `tcld namespace export gcs update` command update export sink. Alias: `u` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --sink-name Provide a name for the sink ###### --enabled Whether the sink is enabled ###### --service-account-email Service account that has access to the sink ###### --gcs-bucket GCS bucket of the sink ###### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ##### validate The `tcld namespace export gcs validate` command validate export sink. Alias: `v` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --sink-name Provide a name for the sink ###### --service-account-email Service account that has access to the sink ###### --gcs-bucket GCS bucket of the sink ##### get The `tcld namespace export gcs get` command get export sink. Alias: `g` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --sink-name Provide a name for the sink ##### delete The `tcld namespace export gcs delete` command delete export sink. Alias: `d` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --sink-name Provide a name for the sink ###### --resource-version The resource-version (etag) to update from, if not set the cli will use the latest (optional) Alias: `v` ###### --request-id The request-id to use for the asynchronous operation, if not set the server will assign one (optional) Alias: `r` ##### list The `tcld namespace export gcs list` command list export sinks. Alias: `l` ###### --namespace The namespace hosted on temporal cloud Alias: `n` ###### --page-size The page size for list operations ###### --page-token The page token for list operations ### set-connectivity-rules The `tcld namespace set-connectivity-rules` command set the connectivity rules for a namespace. Alias: `scrs` #### --namespace The namespace hosted on temporal cloud Alias: `n` #### --connectivity-rule-ids The list of connectivity rule IDs, can be used in create namespace and update namespace. example: --ids id1 --ids id2 --ids id3 Alias: `ids` #### --remove-all Acknowledge that all connectivity rules will be removed, enabling connectivity from any source