`bird workspace mtls update`

Usage

Code example

bird workspace mtls update [flags]

Move each client to the mTLS endpoint while the mode is evaluating, then set enforced. In enforced, the standard endpoint refuses API key, OAuth and Integration calls for the workspace, including this hosted MCP server. Dashboard sessions and automations stay exempt. Set expected_san to null to accept any subject alternative name. A change can take up to 15 minutes to apply to every request.

Build the request from flags, a JSON WorkspaceMTLSSettingsUpdate body via --body-file ("-" reads stdin), or both — a flag overrides the matching body field. Run --example to print a ready-to-edit body, or --dry-run to print the resolved request without sending it.

Browser confirmation: the review link goes to stderr, not stdout, as next[].url in a JSON line that also carries confirmation_id. The command then waits and prints the result on stdout; --confirmation-id waits on an existing one.

Procedure

Step 2 of 3 of "Require client certificates on API requests". Previous: bird workspace mtls certificate-authorities create. Next: bird workspace mtls update. Step 3 of 3 of "Require client certificates on API requests". Previous: bird workspace mtls update.

Examples

Code example

# print the body shape (no credentials needed)
bird workspace mtls update --example

# the body it prints:

Code example

{
  "crl_check": "disabled",
  "expected_san": "spiffe://example.com/billing",
  "state": "disabled"
}

Options

Request

Name	Description
`--body-file`	Read the JSON request body from this file; "-" reads stdin
`--example`	Print a complete example request body, then exit
`--dry-run`	Print the resolved request without sending it, then exit
`--idempotency-key`	Deduplication key; a retry with the same key won't act twice

Options

Name	Description
`--state`	Whether client certificates are off (disabled), checked while the previous behavior stays available (evaluating), or required (enforced). Possible values: disabled, evaluating, enforced.
`--expected-san`	A subject alternative name that every client certificate must contain, as a DNS name or a URI. null accepts any subject alternative name.
`--crl-check`	How a certificate chain is checked against the certificate revocation list (CRL) that each certificate names. With full_chain, the leaf certificate and each intermediate certificate below the trusted root are checked. A certificate that names no CRL is not checked. Possible values: disabled, full_chain.
`--response-schema`	Print the fields this command returns, then exit
`--confirmation-id`	Wait for an existing confirmation of this exact request

Name	Description
`bird workspace mtls get`	Get the mTLS settings

Continue with the documentation, guides and examples for this topic.

Get an implementation brief

Related resources