Temporal CLI cloud namespace command reference

This page provides a reference for the temporal cloud namespace commands. The flags applicable to each subcommand are presented in a table within the heading for the subcommand. Refer to Global Flags for flags that you can use with every subcommand.

apply

Apply a namespace configuration to Temporal Cloud. Creates a new namespace if it doesn't exist, or updates an existing one to match the specification.

The specification can be provided as inline JSON or loaded from a file by prefixing the path with '@'.

Example with inline JSON:

cloud namespace apply --spec '{"name": "namespace-name", "region": "us-west-2", "retention_days": 7}'

Example with file path:

cloud namespace apply --spec @namespace-spec.json

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the namespace already matches the specification. Without this flag, the command errors when no changes are needed.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--spec	Yes	string Namespace configuration in JSON format. Provide inline JSON directly, or use '@path/to/file.json' to load from a file.
--verbose-diff	No	bool Show detailed differences between the current and desired namespace configurations when changes are detected.

cert-ca

Commands for managing the client CA certificates of Temporal Cloud namespaces.

cert-ca create

Add client CA certificates to a Temporal Cloud namespace from a PEM file or base64 encoded string. These certificates are used to verify client connections and enable mTLS authentication.

Specify either --ca-certificate-file or --ca-certificate, but not both.

Example with file:

cloud namespace cert-ca create --namespace my-namespace.my-account --ca-certificate-file ca-cert.pem

Example with base64 encoded data:

cloud namespace cert-ca create --namespace my-namespace.my-account --ca-certificate <base64-encoded-cert>

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--ca-certificate	No	string Base64-encoded CA certificate for mTLS authentication. Mutually exclusive with --ca-certificate-file.
--ca-certificate-file	No	string Path to a CA certificate PEM file for mTLS authentication. Mutually exclusive with --ca-certificate.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

cert-ca delete

Delete client CA certificates from a Temporal Cloud namespace. This operation requires confirmation and will remove the specified certificates from the namespace configuration.

Specify either --ca-certificate-file or --ca-certificate, but not both.

Example with file:

cloud namespace cert-ca delete --namespace my-namespace.my-account --ca-certificate-file ca-cert.pem

Example with base64 encoded data:

cloud namespace cert-ca delete --namespace my-namespace.my-account --ca-certificate <base64-encoded-cert>

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--ca-certificate	No	string Base64-encoded CA certificate for mTLS authentication. Mutually exclusive with --ca-certificate-file.
--ca-certificate-file	No	string Path to a CA certificate PEM file for mTLS authentication. Mutually exclusive with --ca-certificate.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

cert-ca list

Retrieve the list of client CA certificates configured for a Temporal Cloud namespace. These certificates are used for client authentication.

Example:

cloud namespace cert-ca list --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

cert-filter

Commands for managing certificate filters for Temporal Cloud namespaces. Certificate filters restrict mTLS connections to client certificates with specific distinguished name properties.

cert-filter create

Add new certificate filters to a Temporal Cloud namespace. Certificate filters restrict mTLS connections to client certificates whose distinguished name properties match at least one of the filters.

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--common-name	No	string The common name (CN) field from the certificate's distinguished name.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--organization	No	string The organization (O) field from the certificate's distinguished name.
--organizational-unit	No	string The organizational unit (OU) field from the certificate's distinguished name.
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--subject-alternative-name	No	string The subject alternative name (SAN) from the certificate.

cert-filter delete

Delete certificate filters from a Temporal Cloud namespace. Filters are matched by exact field equality.

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--common-name	No	string The common name (CN) field from the certificate's distinguished name.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--organization	No	string The organization (O) field from the certificate's distinguished name.
--organizational-unit	No	string The organizational unit (OU) field from the certificate's distinguished name.
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--subject-alternative-name	No	string The subject alternative name (SAN) from the certificate.

cert-filter list

List all certificate filters configured for a Temporal Cloud namespace.

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

codec

Commands for managing the codec server configuration of Temporal Cloud namespaces.

The codec server is used to encode and decode payloads for workflows and activities.

codec delete

Delete the codec server configuration from a Temporal Cloud namespace.

Example:

cloud namespace codec delete --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

codec get

Retrieve the current codec server configuration for a Temporal Cloud namespace.

Example:

cloud namespace codec get --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

codec set

Set the codec server configuration for a Temporal Cloud namespace.

Example:

cloud namespace codec set --namespace my-namespace.my-account --endpoint https://my-codec.example.com

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--custom-error-message-default-link	No	string A link to display alongside the custom error message for remote codec server errors.
--custom-error-message-default-message	No	string A custom message to display for remote codec server errors.
--endpoint	Yes	string The codec server endpoint URL.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--include-cross-origin-credentials	No	bool Whether to include cross-origin credentials in requests to the codec server.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--pass-access-token	No	bool Whether to pass the user access token to the codec server endpoint.
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

create

Create a new Temporal Cloud namespace with the specified configuration.

Options are passed as individual flags. To create or update a namespace using a full JSON specification, use 'namespace apply' instead.

Example:

cloud namespace create --name my-namespace --region aws-us-east-1 --retention-days 30

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--api-key-auth-enabled	No	bool Enable API key authentication for the namespace.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--ca-certificate	No	string Base64-encoded CA certificate for mTLS authentication. Mutually exclusive with --ca-certificate-file.
--ca-certificate-file	No	string Path to a CA certificate PEM file for mTLS authentication. Mutually exclusive with --ca-certificate.
--certificate-filter	No	string[] Certificate filter as a JSON object (e.g. '{"commonName":"foo"}'). Repeat to add multiple.
--certificate-filter-file	No	string Path to a JSON file containing a certificate filter object.
--codec-endpoint	No	string HTTPS codec server endpoint URL.
--codec-include-cross-origin-credentials	No	bool Include cross-origin credentials in codec server requests.
--codec-pass-access-token	No	bool Pass the user access token to the codec server endpoint.
--connection-rule-id	No	string[] Private connectivity rule ID. Repeat to specify multiple.
--enable-delete-protection	No	bool Prevent accidental deletion of this namespace.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--name, -n	Yes	string The name for the new namespace (becomes part of the namespace ID).
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--region	Yes	string[] Cloud region where the namespace will be hosted. Repeat to specify multiple regions for High Availability (e.g. --region aws-us-east-1 --region aws-us-west-2).
--retention-days	No	int Number of days to retain closed workflow history. If not specified, the server default applies.
--search-attribute	No	string[] Custom search attribute as 'name=Type' (e.g. --search-attribute myAttr=Keyword). Valid types: Text, Keyword, Int, Double, Bool, Datetime, KeywordList. Repeat to add multiple.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

delete

Delete a Temporal Cloud namespace and all associated data. This action is irreversible and will permanently remove all workflows, activities, and history within the namespace.

Example:

cloud namespace delete --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the namespace does not exist. Without this flag, the command errors if the namespace is not found.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

edit

Open a namespace configuration in your default editor for interactive modification. After saving and closing the editor, the changes are applied to Temporal Cloud.

The editor is determined by the EDITOR environment variable, falling back to 'vi' if not set.

Example:

cloud namespace edit --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if no changes were made in the editor. Without this flag, the command errors when the configuration is unchanged.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--verbose-diff	No	bool Show detailed differences between the current and desired namespace configurations when changes are detected.

export

Commands for managing workflow history export sinks for Temporal Cloud namespaces.

Export sinks define destinations (S3 or GCS) to which workflow history is exported.

export delete

Delete a workflow history export sink from a Temporal Cloud namespace.

Example:

cloud namespace export delete --namespace my-namespace.my-account --sink-name my-sink

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--sink-name	Yes	string The name of the export sink.

export disable

Disable a workflow history export sink for a Temporal Cloud namespace. The sink configuration is preserved and can be re-enabled later.

Example:

cloud namespace export disable --namespace my-namespace.my-account --sink-name my-sink

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--sink-name	Yes	string The name of the export sink.

export enable

Enable a previously disabled workflow history export sink for a Temporal Cloud namespace.

Example:

cloud namespace export enable --namespace my-namespace.my-account --sink-name my-sink

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--sink-name	Yes	string The name of the export sink.

export gcs

Commands for managing GCS workflow history export sinks for Temporal Cloud namespaces.

export gcs create

Create a new GCS workflow history export sink for a Temporal Cloud namespace. The sink is created in the enabled state.

Example:

cloud namespace export gcs create --namespace my-namespace.my-account --sink-name my-sink \
  --sa-id my-service-account@my-project.iam.gserviceaccount.com \
  --bucket-name my-bucket --gcp-project-id my-project --region us-central1

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--bucket-name	Yes	string The name of the destination GCS bucket.
--gcp-project-id	Yes	string The GCP project ID associated with the bucket and service account.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--region	Yes	string The GCS bucket region.
--sa-id	Yes	string The customer service account ID that Temporal Cloud impersonates for writing to GCS.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--sink-name	Yes	string The name of the export sink.

export gcs update

Update the configuration of an existing GCS workflow history export sink. The enabled/disabled state is preserved.

Example:

cloud namespace export gcs update --namespace my-namespace.my-account --sink-name my-sink \
  --sa-id my-service-account@my-project.iam.gserviceaccount.com \
  --bucket-name my-bucket --gcp-project-id my-project --region us-central1

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--bucket-name	Yes	string The name of the destination GCS bucket.
--gcp-project-id	Yes	string The GCP project ID associated with the bucket and service account.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--region	Yes	string The GCS bucket region.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--sa-id	Yes	string The customer service account ID that Temporal Cloud impersonates for writing to GCS.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--sink-name	Yes	string The name of the export sink.

export gcs validate

Validate a GCS workflow history export sink configuration without creating or updating it. A successful response means the configuration is valid.

Example:

cloud namespace export gcs validate --namespace my-namespace.my-account --sink-name my-sink \
  --sa-id my-service-account@my-project.iam.gserviceaccount.com \
  --bucket-name my-bucket --gcp-project-id my-project --region us-central1

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--bucket-name	Yes	string The name of the destination GCS bucket.
--gcp-project-id	Yes	string The GCP project ID associated with the bucket and service account.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--region	Yes	string The GCS bucket region.
--sa-id	Yes	string The customer service account ID that Temporal Cloud impersonates for writing to GCS.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--sink-name	Yes	string The name of the export sink.

export get

Retrieve the configuration and status of a workflow history export sink for a Temporal Cloud namespace.

Example:

cloud namespace export get --namespace my-namespace.my-account --sink-name my-sink

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--sink-name	Yes	string The name of the export sink.

export list

List all workflow history export sinks configured for a Temporal Cloud namespace.

Example:

cloud namespace export list --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

export s3

Commands for managing S3 workflow history export sinks for Temporal Cloud namespaces.

export s3 create

Create a new S3 workflow history export sink for a Temporal Cloud namespace. The sink is created in the enabled state.

Example:

cloud namespace export s3 create --namespace my-namespace.my-account --sink-name my-sink \
  --role-name arn:aws:iam::123456789012:role/my-role --bucket-name my-bucket \
  --region us-east-1 --aws-account-id 123456789012

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--aws-account-id	Yes	string The AWS account ID associated with the bucket and role.
--bucket-name	Yes	string The name of the destination S3 bucket.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--kms-arn	No	string The AWS KMS key ARN for server-side encryption of exported data. Optional.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--region	Yes	string The AWS region where the S3 bucket is located.
--role-name	Yes	string The IAM role ARN that Temporal Cloud assumes for writing to S3.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--sink-name	Yes	string The name of the export sink.

export s3 update

Update the configuration of an existing S3 workflow history export sink. The enabled/disabled state is preserved.

Example:

cloud namespace export s3 update --namespace my-namespace.my-account --sink-name my-sink \
  --role-name arn:aws:iam::123456789012:role/my-new-role --bucket-name my-bucket \
  --region us-east-1 --aws-account-id 123456789012

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--aws-account-id	Yes	string The AWS account ID associated with the bucket and role.
--bucket-name	Yes	string The name of the destination S3 bucket.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--kms-arn	No	string The AWS KMS key ARN for server-side encryption of exported data. Optional.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--region	Yes	string The AWS region where the S3 bucket is located.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--role-name	Yes	string The IAM role ARN that Temporal Cloud assumes for writing to S3.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--sink-name	Yes	string The name of the export sink.

export s3 validate

Validate an S3 workflow history export sink configuration without creating or updating it. A successful response means the configuration is valid.

Example:

cloud namespace export s3 validate --namespace my-namespace.my-account --sink-name my-sink \
  --role-name arn:aws:iam::123456789012:role/my-role --bucket-name my-bucket \
  --region us-east-1 --aws-account-id 123456789012

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--aws-account-id	Yes	string The AWS account ID associated with the bucket and role.
--bucket-name	Yes	string The name of the destination S3 bucket.
--kms-arn	No	string The AWS KMS key ARN for server-side encryption of exported data. Optional.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--region	Yes	string The AWS region where the S3 bucket is located.
--role-name	Yes	string The IAM role ARN that Temporal Cloud assumes for writing to S3.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--sink-name	Yes	string The name of the export sink.

get

Retrieve the configuration and status of a Temporal Cloud namespace.

Returns details including region, retention period, endpoints, and certificate information.

Example:

cloud namespace get --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--spec	No	bool Output only the namespace specification in JSON format, omitting metadata and status information.

ha

Commands for managing High Availability (HA) settings of Temporal Cloud namespaces.

HA settings control active region, managed failover, and replica regions.

ha failover

Trigger a failover for a Temporal Cloud namespace to a different region. The target region must already be a replica region of the namespace.

Example:

cloud namespace ha failover --namespace my-namespace.my-account --region aws-us-west-2

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--region	Yes	string The target region to failover to (e.g., aws-us-west-2).
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

ha get

Retrieve the current High Availability configuration for a Temporal Cloud namespace. Shows the active region and whether managed failover is enabled.

Example:

cloud namespace ha get --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

ha region

Commands for managing replica regions of Temporal Cloud namespaces.

ha region add

Add a replica region to a Temporal Cloud namespace. The region will be added as a passive replica and can later be used for failover.

Example:

cloud namespace ha region add --namespace my-namespace.my-account --region aws-us-west-2

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--region	Yes	string The region ID to add as a replica (e.g., aws-us-west-2).
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

ha region delete

Remove a replica region from a Temporal Cloud namespace. Note that a 7-day cooldown period applies before the same region can be re-added.

Example:

cloud namespace ha region delete --namespace my-namespace.my-account --region aws-us-west-2

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--region	Yes	string The region ID to remove (e.g., aws-us-west-2).
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

ha region list

List all regions and their states for a Temporal Cloud namespace.

Example:

cloud namespace ha region list --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

ha update

Update the High Availability configuration for a Temporal Cloud namespace. Use --disable-auto-failover to toggle Temporal-managed automatic failover.

Example:

cloud namespace ha update --namespace my-namespace.my-account --disable-auto-failover true

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--disable-auto-failover	Yes	bool Set to true to disable Temporal-managed automatic failover for the namespace. Set to false to re-enable automatic failover.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

lifecycle

Commands for managing lifecycle settings of Temporal Cloud namespaces.

Lifecycle settings control the behavior and protection of namespaces, including delete protection to prevent accidental deletion.

lifecycle get

Retrieve the current lifecycle configuration for a Temporal Cloud namespace. Lifecycle settings include delete protection status.

Example:

cloud namespace lifecycle get --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

lifecycle set

Set the lifecycle configuration for a Temporal Cloud namespace. Lifecycle settings include delete protection to prevent accidental deletion.

Example:

cloud namespace lifecycle set --namespace my-namespace.my-account --enable-delete-protection true

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--enable-delete-protection	Yes	bool Enable or disable delete protection for the namespace. When enabled, the namespace cannot be deleted until this flag is set to false.
--idempotent	No	bool Succeed silently if the lifecycle configuration is already set to the specified value. Without this flag, the command errors when no change is needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--resource-version	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--verbose-diff	No	bool Show detailed differences between the current and desired namespace configurations when changes are detected.

list

List all Temporal Cloud namespaces accessible with the current authentication credentials.

Example:

cloud namespace list

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--name	No	string Filter namespaces by the name as defined in the specification of the namespace.
--page-size	No	int Number of namespaces to return per page. Use for paginated results.
--page-token	No	string Token for retrieving the next page of results in a paginated list.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

retention

Commands for managing data retention settings of Temporal Cloud namespaces.

Retention determines how long closed workflow history data are stored before being automatically deleted.

retention get

Retrieve the current data retention period for a Temporal Cloud namespace. The retention period defines how long closed workflow history data are stored.

Example:

cloud namespace retention get --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

retention set

Set the data retention period for a Temporal Cloud namespace. The retention period defines how long closed workflow history data are stored.

Example:

cloud namespace retention set --namespace my-namespace.my-account --retention-days 14

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--retention-days	Yes	int New retention period in days for closed workflow history data.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

search-attribute

Commands for managing custom search attributes for Temporal Cloud namespaces. Search attributes enable filtering and searching workflows by custom fields.

search-attribute create

Create a new custom search attribute for a Temporal Cloud namespace.

Example:

cloud namespace search-attribute create --namespace my-namespace.my-account --name MyField --type Keyword

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--name	Yes	string The name of the search attribute to create.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--type	Yes	string The type of the search attribute. Valid values: Text, Keyword, Int, Double, Bool, Datetime, KeywordList.

search-attribute list

List all custom search attributes configured for a Temporal Cloud namespace.

Example:

cloud namespace search-attribute list --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

search-attribute rename

Rename an existing custom search attribute for a Temporal Cloud namespace. This operation preserves all existing data associated with the search attribute.

Example:

cloud namespace search-attribute rename --namespace my-namespace.my-account --existing-name OldField --new-name NewField

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--existing-name	Yes	string The current name of the search attribute to rename.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--new-name	Yes	string The new name for the search attribute.
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--resource-version, -v	No	string Resource version for optimistic concurrency control. If not provided, the current version is fetched automatically.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

tag

Commands for managing tags of Temporal Cloud namespaces.

Tags are key-value pairs used for organization and categorization of namespaces.

tag create

Create a new tag for a Temporal Cloud namespace. Fails if a tag with the specified key already exists.

Example:

cloud namespace tag create --namespace my-namespace.my-account --key environment --value production

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--key	Yes	string The tag key.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--value	Yes	string The tag value.

tag delete

Delete a tag from a Temporal Cloud namespace by its key.

Example:

cloud namespace tag delete --namespace my-namespace.my-account --key environment

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--key	Yes	string The tag key to delete.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

tag list

List all tags configured for a Temporal Cloud namespace.

Example:

cloud namespace tag list --namespace my-namespace.my-account

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.

tag update

Update the value of an existing tag for a Temporal Cloud namespace. Fails if the specified tag key does not exist.

Example:

cloud namespace tag update --namespace my-namespace.my-account --key environment --value staging

Use the following options to change the behavior of this command. You can also use any of the global flags that apply to all subcommands.

Flag	Required	Description
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--async	No	bool Return immediately after initiating the operation instead of waiting for completion. Use the returned operation ID to check status later.
--async-operation-id	No	string Custom identifier for tracking this async operation. If not provided, a unique ID is generated automatically.
--idempotent	No	bool Succeed silently if the resource already exists or matches the specification. Without this flag, the command errors when no changes are needed.
--key	Yes	string The tag key to update.
--namespace, -n	Yes	string The fully qualified namespace name in the format 'namespace.account' (e.g., 'my-namespace.my-account').
--poll-interval	No	duration Time to wait between status checks when waiting for operation completion. Cannot be greater than 10 minutes. Supports minutes (m) and seconds (s). Default is 1s.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.
--value	Yes	string The new value for the tag.

Global Flags

The following options can be used with any command.

Flag	Required	Description	Default
--api-key	No	string API key for authenticating with Temporal Cloud. Can be used instead of interactive login for automation and CI/CD pipelines.
--auto-confirm	No	bool Automatically confirm prompts and actions that require user confirmation. Useful for scripting and automation.
--config-dir	No	string Directory path where CLI configuration files are stored, including authentication tokens and settings.
--disable-pop-up	No	bool Prevent the CLI from opening a browser window during authentication. Useful for headless environments or when using alternative auth methods.
--server	No	string Override the Temporal Cloud API server address. Used for connecting to non-production environments.	saas-api.tmprl-test.cloud:443