temporal cloud user-group members remove command flags
The 'temporal cloud user-group members remove' command accepts the following flags: --api-key (string, optional), --async (bool, optional), --async-operation-id (string, optional), --group-id (string, required), --idempotent (bool, optional), --poll-interval (duration, optional, max 10 minutes, supports m and s), --server (string, optional), --user-email (string, optional, mutually exclusive with --user-id), --user-id (string, optional, mutually exclusive with --user-email).
temporal cloud user-group set-namespace-permissions command flags
The 'temporal cloud user-group set-namespace-permissions' command accepts the following flags: --api-key (string, optional), --async (bool, optional), --async-operation-id (string, optional), --group-id (string, required), --idempotent (bool, optional), --namespace-access (string array, required, repeatable, format 'namespace=permission' where permission is one of admin, write, read, or empty string to remove access), --poll-interval (duration, optional, max 10 minutes, supports m and s), --resource-version/-v (string, optional), --server (string, optional).
temporal cloud user-group update command flags
The 'temporal cloud user-group update' command accepts the following flags: --account-role (string, optional, must be one of: admin, developer, finance-admin, read), --api-key (string, optional), --async (bool, optional), --async-operation-id (string, optional), --custom-role (string array, optional, repeatable, replaces existing custom role list when provided), --group-id (string, required), --idempotent (bool, optional), --namespace-access (string array, optional, repeatable, format 'namespace=permission' where permission is one of admin, write, read, or empty string to remove access), --poll-interval (duration, optional, max 10 minutes, supports m and s), --resource-version/-v (string, optional), --server (string, optional).
temporal cloud user-group update command
The 'temporal cloud user-group update' command updates an existing Temporal Cloud user group's access settings. At least one of --account-role, --namespace-access, or --custom-role must be provided. Example: temporal cloud user-group update --group-id my-group-id --account-role developer. Alternative example: temporal cloud user-group update --group-id my-group-id --namespace-access my-namespace.my-account=write. Combined example: temporal cloud user-group update --group-id my-group-id --account-role admin --namespace-access my-namespace.my-account=write --namespace-access other-namespace.my-account=read.
temporal cloud user-group set-namespace-permissions command
The 'temporal cloud user-group set-namespace-permissions' command adds, updates, or removes namespace-level permissions for a Temporal Cloud user group. Changes are applied additively: namespaces not listed are left unchanged. Namespace access format is 'namespace=permission' where permission is one of: admin, write, read. To remove access to a namespace, pass an empty permission: 'namespace='. Example: temporal cloud user-group set-namespace-permissions --group-id my-group-id --namespace-access my-namespace.my-account=write --namespace-access other-namespace.my-account=read.
temporal cloud user-group set-account-role command flags
The 'temporal cloud user-group set-account-role' command accepts the following flags: --account-role (string, required, valid values: owner, admin, developer, finance-admin, read, metrics-read), --api-key (string, optional), --async (bool, optional), --async-operation-id (string, optional), --group-id (string, required), --idempotent (bool, optional), --poll-interval (duration, optional, max 10 minutes, supports m and s), --resource-version/-v (string, optional), --server (string, optional).
temporal cloud user-group set-account-role command
The 'temporal cloud user-group set-account-role' command sets the account-level role for a Temporal Cloud user group. Account roles are: owner, admin, developer, finance-admin, read, metrics-read. Example: temporal cloud user-group set-account-role --group-id my-group-id --account-role developer.
temporal cloud user-group set-custom-roles command flags
The 'temporal cloud user-group set-custom-roles' command accepts the following flags: --api-key (string, optional), --async (bool, optional), --async-operation-id (string, optional), --custom-role (string array, optional, repeatable, replaces existing custom role list when provided), --group-id (string, required), --idempotent (bool, optional), --poll-interval (duration, optional, max 10 minutes, supports m and s), --resource-version/-v (string, optional), --server (string, optional).
temporal cloud user-group set-custom-roles command
The 'temporal cloud user-group set-custom-roles' command sets the custom roles assigned to a Temporal Cloud user group. It replaces the group's current custom role list. Pass no --custom-role flags to remove all custom roles. Example: temporal cloud user-group set-custom-roles --group-id my-group-id --custom-role role-id-1 --custom-role role-id-2.
temporal cloud user-group members remove command
The 'temporal cloud user-group members remove' command removes a user from a Temporal Cloud user group. The user must be specified with either --user-id or --user-email (not both). Example: temporal cloud user-group members remove --group-id my-group-id --user-id my-user-id. Alternative example: temporal cloud user-group members remove --group-id my-group-id --user-email alice@example.com.
temporal cloud user-group members list command flags
The 'temporal cloud user-group members list' command accepts the following flags: --api-key (string, optional), --group-id (string, required), --page-size (int, optional), --page-token (string, optional), --server (string, optional).
temporal cloud user-group members list command
The 'temporal cloud user-group members list' command lists all members of a Temporal Cloud user group. Example: temporal cloud user-group members list --group-id my-group-id.
temporal cloud user-group get command flags
The 'temporal cloud user-group get' command accepts the following flags: --api-key (string, optional), --group-id (string, required), --server (string, optional).
temporal cloud user-group get command
The 'temporal cloud user-group get' command retrieves the configuration and status of a Temporal Cloud user group. Example: temporal cloud user-group get --group-id my-group-id.
temporal cloud user-group edit command flags
The 'temporal cloud user-group edit' command accepts the following flags: --api-key (string, optional), --async (bool, optional), --async-operation-id (string, optional), --group-id (string, required), --idempotent (bool, optional), --poll-interval (duration, optional, max 10 minutes, supports m and s), --resource-version/-v (string, optional), --server (string, optional), --verbose-diff (bool, optional).
temporal cloud user-group edit command
The 'temporal cloud user-group edit' command opens a user group configuration in the default editor for interactive modification. After saving and closing the editor, the changes are applied to Temporal Cloud. The editor is determined by the EDITOR environment variable, falling back to 'vi' if not set. Example: temporal cloud user-group edit --group-id my-group-id.
temporal cloud user-group delete command
The 'temporal cloud user-group delete' command deletes a Temporal Cloud user group. This action is irreversible. Example: temporal cloud user-group delete --group-id my-group-id.
temporal cloud user-group create-scim-group command flags
The 'temporal cloud user-group create-scim-group' command accepts the following flags: --account-role (string, optional, valid values: owner, admin, developer, finance-admin, read, metrics-read), --api-key (string, optional), --async (bool, optional), --async-operation-id (string, optional), --custom-role (string array, optional, repeatable), --display-name (string, required), --idempotent (bool, optional), --namespace-access (string array, optional, repeatable, format 'namespace=permission'), --poll-interval (duration, optional, max 10 minutes, supports m and s), --scim-idp-id (string, required), --server (string, optional).
temporal cloud user-group create-scim-group command
The 'temporal cloud user-group create-scim-group' command creates a new user group backed by a SCIM identity provider group. Members are managed via the upstream identity provider. Account roles are: owner, admin, developer, finance-admin, read, metrics-read. Namespace access format is 'namespace=permission' where permission is one of: admin, write, read. Example: temporal cloud user-group create-scim-group --display-name "Security" --scim-idp-id idp-group-id-123 --account-role read.
temporal cloud user-group apply command flags
The 'temporal cloud user-group apply' command accepts the following flags: --api-key (string, optional), --async (bool, optional), --async-operation-id (string, optional), --idempotent (bool, optional), --poll-interval (duration, optional, max 10 minutes, supports m and s), --resource-version/-v (string, optional), --server (string, optional), --spec (string, required), --verbose-diff (bool, optional). The --spec flag is required and accepts user group configuration in JSON format either as inline JSON or as '@path/to/file.json' to load from a file.
temporal cloud user-group apply command
The 'temporal cloud user-group apply' command applies a user group configuration to Temporal Cloud. It creates a new user group if no group with the given display name exists, or updates the existing one to match the specification. The specification can be provided as inline JSON or loaded from a file by prefixing the path with '@'. Example with inline JSON: temporal cloud user-group apply --spec '{"display_name": "Engineering", "cloud_group": {}, "access": {"account_access": {"role": "developer"}}}'. Example with file path: temporal cloud user-group apply --spec @user-group-spec.json.
temporal cloud user-group members add command
The 'temporal cloud user-group members add' command adds a user to a Temporal Cloud user group. The user must be specified with either --user-id or --user-email (not both). Example: temporal cloud user-group members add --group-id my-group-id --user-id my-user-id. Alternative example: temporal cloud user-group members add --group-id my-group-id --user-email alice@example.com.
temporal cloud user-group list command
The 'temporal cloud user-group list' command lists all Temporal Cloud user groups accessible with the current authentication credentials. Example: temporal cloud user-group list.
temporal cloud user-group create-google-group command
The 'temporal cloud user-group create-google-group' command creates a new user group backed by a Google Group. Members are managed via the Google Group itself. Account roles are: owner, admin, developer, finance-admin, read, metrics-read. Namespace access format is 'namespace=permission' where permission is one of: admin, write, read. Example: temporal cloud user-group create-google-group --display-name "Platform" --google-group-email platform@example.com --account-role developer.
temporal cloud whoami example usage
The temporal cloud whoami command can be invoked with: temporal cloud whoami
Temporal CLI global flags for all commands
The following global flags can be used with any Temporal CLI command: --api-key (optional string, API key for authenticating with Temporal Cloud, used for automation and CI/CD pipelines); --auto-confirm (optional bool, automatically confirm prompts and actions requiring user confirmation, useful for scripting and automation); --config-dir (optional string, directory path where CLI configuration files are stored, including authentication tokens and settings); --disable-pop-up (optional bool, prevents the CLI from opening a browser window during authentication, useful for headless environments or alternative auth methods); --server (optional string, overrides the Temporal Cloud API server address for non-production environments, defaults to saas-api.tmprl.cloud:443).
temporal cloud whoami command-specific flags
The temporal cloud whoami command accepts the following flags: --api-key (optional string, API key for authenticating with Temporal Cloud, can be used instead of interactive login for automation and CI/CD pipelines) and --server (optional string, overrides the Temporal Cloud API server address, used for connecting to non-production environments).
temporal cloud whoami command displays authenticated identity
The temporal cloud whoami command displays information about the currently authenticated identity, showing whether you are authenticated as a user or service account, along with the associated API key if one is in use.
Temporal CLI global flags reference
Global flags for Temporal CLI commands include: `--address` (string, default `localhost:7233`), `--api-key` (string), `--client-authority` (string), `--client-connect-timeout` (duration), `--codec-auth` (string), `--codec-endpoint` (string), `--codec-header` (string array, KEY=VALUE format), `--color` (string-enum: always/never/auto, default `auto`), `--command-timeout` (duration), `--config-file` (string, defaults to `$CONFIG_PATH/temporalio/temporal.toml`), `--disable-config-env` (bool), `--disable-config-file` (bool), `--env` (string, default `default`), `--env-file` (string, defaults to `$HOME/.config/temporalio/temporal.yaml`), `--grpc-meta` (string array, KEY=VALUE format), `--identity` (string, defaults to `temporal-cli:$USER@$HOST`), `--log-format` (string-enum: text/json, default `text`), `--log-level` (string-enum: debug/info/warn/error/never, default `never`), `--namespace` or `-n` (string, default `default`), `--no-json-shorthand-payloads` (bool), `--output` or `-o` (string-enum: text/json/jsonl/none, default `text`), `--profile` (string), `--time-format` (string-enum: relative/iso/raw, default `relative`), `--tls` (bool, defaults to true if api-key or other TLS options are present), `--tls-ca-data` (string), `--tls-ca-path` (string), `--tls-cert-data` (string), `--tls-cert-path` (string), `--tls-disable-host-verification` (bool), `--tls-key-data` (string), `--tls-key-path` (string), `--tls-server-name` (string).
temporal config set command
Assign a value to a property and store it in the config file using `temporal config set --prop <property-name> --value <property-value>`. Both `--prop` (or `-p`) and `--value` (or `-v`) flags are required. Example: `temporal config set --prop address --value us-west-2.aws.api.temporal.io:7233`
temporal config get command
Display specific properties or the entire profile using `temporal config get`. The `--prop` or `-p` flag is optional and specifies which property to display. Example: `temporal config get --prop address` displays a single property, or `temporal config get` displays the entire profile.
temporal config list command
List all profile names in the config file using `temporal config list`. This command displays the names of profiles available in the configuration.
temporal config delete command
Remove a property within a profile using `temporal config delete --prop <property-name>`. The `--prop` or `-p` flag is required and specifies which property to delete. If the property is not set, the entire profile is deleted. Example: `temporal config delete --prop tls.client_cert_path`
temporal config delete-profile command
Remove an entire profile using `temporal config delete-profile --profile <profile-name>`. The `--profile` flag must be explicitly set. This deletes the full profile entirely.
Temporal CLI command categories
The Temporal CLI includes the following command categories: activity, batch, cloud, config, env, operator, schedule, server, task-queue, worker, and workflow. Each category groups related subcommands for managing different aspects of Temporal.
Config path locations across platforms in Temporal CLI
$CONFIG_PATH defaults are platform-specific: $HOME/.config on Unix, $HOME/Library/Application Support on macOS, and %AppData% on Windows. The config file defaults to $CONFIG_PATH/temporalio/temporal.toml.
temporal env delete command syntax and options
The 'temporal env delete' command removes an entire environment or a specific key-value pair. If no environment is specified with --env or TEMPORAL_ENV variable, it updates the 'default' environment. Syntax: temporal env delete --env YourEnvironment or temporal env delete --env prod --key tls-key-path. The --key (-k) flag is optional and specifies the property name to delete.
gRPC meta header format in Temporal CLI
The --grpc-meta flag accepts HTTP headers for requests. Format is KEY=VALUE pairs. The flag may be passed multiple times to set multiple headers. Headers can also be made available via environment variable as TEMPORAL_GRPC_META_[name].
Codec header format in Temporal CLI
The --codec-header flag accepts HTTP headers for requests to codec server. Format is KEY=VALUE pairs. The flag may be passed multiple times to set multiple headers.
TLS option conflicts in Temporal CLI
TLS options in Temporal CLI have mutual exclusivity constraints: --tls-ca-data and --tls-ca-path cannot be used together; --tls-cert-data and --tls-cert-path cannot be used together; --tls-key-data and --tls-key-path cannot be used together.
Temporal CLI global flags complete reference
Global flags for all CLI commands:
| Flag | Required | Type | Default |
|------|----------|------|----------|
| --address | No | string | localhost:7233 |
| --api-key | No | string | (empty) |
| --client-authority | No | string | (empty) |
| --client-connect-timeout | No | duration | (empty) |
| --codec-auth | No | string | (empty) |
| --codec-endpoint | No | string | (empty) |
| --codec-header | No | string[] | (empty) |
| --color | No | string-enum (always, never, auto) | auto |
| --command-timeout | No | duration | (empty) |
| --config-file | No | string | $CONFIG_PATH/temporalio/temporal.toml |
| --disable-config-env | No | bool | (false) |
| --disable-config-file | No | bool | (false) |
| --env | No | string (ENV) | default |
| --env-file | No | string | $HOME/.config/temporalio/temporal.yaml |
| --grpc-meta | No | string[] | (empty) |
| --identity | No | string | temporal-cli:$USER@$HOST |
| --log-format | No | string-enum (text, json) | text |
| --log-level | No | string-enum (debug, info, warn, error, never) | never (warn for server start-dev) |
| --namespace (-n) | No | string | default |
| --no-json-shorthand-payloads | No | bool | (false) |
| --output (-o) | No | string-enum (text, json, jsonl, none) | text |
| --profile | No | string | (empty) |
| --time-format | No | string-enum (relative, iso, raw) | relative |
| --tls | No | bool | true if api-key or other TLS options present |
| --tls-ca-data | No | string | (empty) |
| --tls-ca-path | No | string | (empty) |
| --tls-cert-data | No | string | (empty) |
| --tls-cert-path | No | string | (empty) |
| --tls-disable-host-verification | No | bool | (false) |
| --tls-key-data | No | string | (empty) |
| --tls-key-path | No | string | (empty) |
| --tls-server-name | No | string | (empty) |
temporal env get command syntax and options
The 'temporal env get' command lists properties for a given environment, or prints a single property if --key is specified. Syntax: temporal env get --env YourEnvironment lists all properties, or temporal env get --env YourEnvironment --key YourPropertyKey prints a single property. If no environment is specified, it lists properties of the 'default' environment. The --key (-k) flag is optional.
temporal env set command syntax and options
The 'temporal env set' command assigns a value to a property key and stores it to an environment. Syntax: temporal env set --env environment --key property --value value. If no environment is specified with --env or TEMPORAL_ENV variable, it sets properties in the 'default' environment. Storing keys with CLI option names allows the CLI to automatically set those options. The --key (-k) flag is required for property name, and --value (-v) flag is required for property value.
temporal env list command
The 'temporal env list' command lists all environments configured on the local computer. Environments are stored in '$HOME/.config/temporalio/temporal.yaml'.
temporal operator namespace describe flags
The `temporal operator namespace describe` command accepts the following flag: `--namespace-id` (string, not required) to identify a namespace by its ID, or use the global `--namespace` flag to identify by name.
temporal operator namespace create flags
The `temporal operator namespace create` command accepts the following flags: `--namespace` (required, string), `--active-cluster` (string), `--cluster` (string array, can pass multiple times), `--data` (string array, KEY=VALUE pairs, can pass multiple times), `--description` (string), `--email` (string), `--global` (bool), `--history-archival-state` (string-enum: disabled, enabled), `--history-uri` (string), `--retention` (duration), `--visibility-archival-state` (string-enum: disabled, enabled), `--visibility-uri` (string). URI values for archival states cannot be changed once enabled.
temporal operator cluster upsert flags
The `temporal operator cluster upsert` command accepts the following flags: `--frontend-address` (string, required) specifying the remote endpoint; `--enable-connection` (bool, not required) to set connection to enabled; `--enable-replication` (bool, not required) to set replication to enabled.
temporal operator cluster system command
The `temporal operator cluster system` command shows Temporal Server information for Clusters including server version and scheduling support. It defaults to the local Service but can specify a remote cluster using `--frontend-address`.
temporal operator cluster remove flags
The `temporal operator cluster remove` command accepts the following required flags: `--name` (string) specifying the Cluster/Service name to remove.
temporal operator cluster list flags
The `temporal operator cluster list` command accepts the following flags: `--limit` (int, not required) to set the maximum number of Clusters to display.
temporal operator cluster health command
The `temporal operator cluster health` command displays information about the health of a Temporal Service. It uses only global flags to customize the connection.
temporal operator cluster describe flags
The `temporal operator cluster describe` command accepts the following flags: `--detail` (bool, not required) to show history shard count and Cluster/Service version information.
temporal operator namespace list command
The `temporal operator namespace list` command displays detailed listings for all Namespaces on the Service and uses only global flags.
temporal operator nexus endpoint create flags
The `temporal operator nexus endpoint create` command accepts the following flags: `--name` (string, required), `--target-namespace` (string), `--target-task-queue` (string), `--target-url` (string, experimental), `--description` (string), `--description-file` (string). Either `--target-namespace` and `--target-task-queue` must both be provided, or `--target-url` must be provided.
temporal operator nexus endpoint get flags
The `temporal operator nexus endpoint get` command accepts the following required flag: `--name` (string) specifying the endpoint name.
temporal operator nexus endpoint update flags
The `temporal operator nexus endpoint update` command accepts the following flags: `--name` (string, required), `--target-namespace` (string), `--target-task-queue` (string), `--target-url` (string, experimental), `--description` (string), `--description-file` (string), `--unset-description` (bool). The endpoint is patched; existing fields for which flags are not provided are left unchanged.
temporal operator namespace update flags
The `temporal operator namespace update` command accepts the following flags: `--namespace` (required, string), `--active-cluster` (string), `--cluster` (string array), `--data` (string array, KEY=VALUE pairs), `--description` (string), `--email` (string), `--history-archival-state` (string-enum: disabled, enabled), `--history-uri` (string), `--promote-global` (bool), `--replication-state` (string-enum: normal, handover), `--retention` (duration), `--visibility-archival-state` (string-enum: disabled, enabled), `--visibility-uri` (string). URI values for archival states cannot be changed once enabled.
temporal operator namespace delete flags
The `temporal operator namespace delete` command accepts the following flags: `--yes` or `-y` (bool, not required) to skip confirmation before deletion.
temporal operator nexus endpoint list command
The `temporal operator nexus endpoint list` command lists all Nexus Endpoints on the Server and uses only global flags.
temporal operator search-attribute create flags
The `temporal operator search-attribute create` command accepts the following required flags: `--name` (string array, can pass multiple times) and `--type` (string-enum array, can pass multiple times). Supported types are: Text, Keyword, Int, Double, Bool, Datetime, KeywordList.