---
title: "bird workspace mtls update"
description: "Update the mTLS settings"
canonical: "https://bird.com/docs/cli/reference/workspace-mtls-update"
---

# `bird workspace mtls update`

## Usage

```bash
bird workspace mtls update [flags]
```

## Description

Update the mTLS settings

Move each client to the mTLS endpoint while the mode is `evaluating`, then set `enforced`. In `enforced`, the standard endpoint refuses API key and Integration calls for the workspace. Set `expected_san` to `null` to accept any subject alternative name. A change can take up to 15 minutes to apply to every request.

Build the request from flags, a JSON WorkspaceMTLSSettingsUpdate body via --body-file ("-" reads
stdin), or both — a flag overrides the matching body field. Run --example to
print a ready-to-edit body, or --dry-run to print the resolved request without
sending it.

Browser confirmation: the review link goes to stderr, not stdout, as next[].url
in a JSON line that also carries confirmation\_id. The command then waits and
prints the result on stdout; --confirmation-id waits on an existing one.

## Procedure

Step 2 of 3 of "Require client certificates on API requests". Previous: bird workspace mtls certificate-authorities create. Next: bird workspace mtls update. Step 3 of 3 of "Require client certificates on API requests". Previous: bird workspace mtls update.

## Examples

```bash
# print the body shape (no credentials needed)
bird workspace mtls update --example

# the body it prints:
```

```json
{
  "crl_check": "disabled",
  "expected_san": "spiffe://example.com/billing",
  "state": "disabled"
}
```

## Options

#### Request

| Name                | Description                                                  |
| ------------------- | ------------------------------------------------------------ |
| `--body-file`       | Read the JSON request body from this file; "-" reads stdin   |
| `--example`         | Print a complete example request body, then exit             |
| `--dry-run`         | Print the resolved request without sending it, then exit     |
| `--idempotency-key` | Deduplication key; a retry with the same key won't act twice |

#### Options

| Name                | Description                                                                                                                                                                                                                                                                                                        |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `--state`           | Whether client certificates are off (disabled), checked while the previous behavior stays available (evaluating), or required (enforced). Possible values: disabled, evaluating, enforced.                                                                                                                         |
| `--expected-san`    | A subject alternative name that every client certificate must contain, as a DNS name or a URI. null accepts any subject alternative name.                                                                                                                                                                          |
| `--crl-check`       | How a certificate chain is checked against the certificate revocation list (CRL) that each certificate names. With full\_chain, the leaf certificate and each intermediate certificate below the trusted root are checked. A certificate that names no CRL is not checked. Possible values: disabled, full\_chain. |
| `--response-schema` | Print the fields this command returns, then exit                                                                                                                                                                                                                                                                   |
| `--confirmation-id` | Wait for an existing confirmation of this exact request                                                                                                                                                                                                                                                            |

## Related

| Name                                                                | Description           |
| ------------------------------------------------------------------- | --------------------- |
| [`bird workspace mtls get`](/docs/cli/reference/workspace-mtls-get) | Get the mTLS settings |

## Related resources

- [Should I use a Bird SDK or call the API directly?](/explained/platform/should-i-use-an-sdk-or-call-the-api-directly) (answer)
- [Build your first integration](/learn/paths/integration) (course)
- [Send your first email](/docs/get-started/send-your-first-email) (docs)

[Get an implementation brief](/learn/workspace?topic=api-basics)