Skip to content

Workspace Settings

Manage > Workspace Settings is the core configuration center for a workspace. Workspace owners and administrators can perform the following actions here:

  • View workspace version, site, tokens, member count, and other data.
  • Export/import dashboards, monitors, and other configurations for cross-workspace reuse.
  • Ensure data security through multiple mechanisms such as MFA, IP allowlists, and invitation approval.
  • Execute irreversible operations such as adjusting storage policies and cleaning historical data.

Basic Information

Displays core information about the current workspace. Only owners and administrators can edit.

Field Description Visibility Editable
Current Version Commercial Plan / Free Plan All members No
Site Data center node where the workspace is deployed (e.g., Alibaba Cloud, Huawei Cloud, AWS, etc.) All members No
Workspace Name Name displayed in the workspace switcher in the top-left corner All members Yes
Workspace Language Language for system events, alerts, and SMS templates All members Yes
Workspace Note Personal identification information Visible only to yourself Yes
Workspace Description Description of the workspace's purpose All members Yes
Workspace ID Globally unique identifier (starts with wksp_) All members No
Token Authentication key for data ingestion Owner/Administrator Yes
Member Count Number of members currently in the workspace All members No

Workspace Language

Supports Chinese or English. After switching, system events, alert notifications, SMS templates, etc., will use the corresponding language by default.

Note

  • The "Workspace Language" here applies only to the current settings page and does not affect the display language of the interface after you enter the workspace. Upon login, the system will prioritize the display language used the last time the browser successfully accessed the console. If there is no record, the browser's current language will be used. For example, if the browser language is Chinese, the console will default to displaying in Chinese.

  • Only the workspace owner or administrator has the permission to modify this language setting.

Note

Add a note for the current workspace that is visible only to yourself.

The note will be displayed together with the workspace name in the top-left corner for quick identification.

Description

Adds a description for the current workspace. After successful addition, it can be viewed directly in the workspace selector in the top-left corner for easy identification.

Token

A token is the authentication credential for DataKit and OpenAPI data ingestion.

View and Copy

Click the copy button next to the token to copy the complete key.

Replace Token

Click Replace, set the expiration time for the old token, and generate a new token:

  • Immediate expiration
  • 10 minutes
  • 6 hours
  • 12 hours
  • 24 hours
Replace Notice

If you select "Immediate expiration", DataKit using the old token will stop reporting immediately, potentially causing monitoring interruptions and alert failures.

Edit Token Configuration

Click Edit to configure:

  • Custom Token: Set a custom key (optional).

  • Enable Data Query: Allow querying platform data through the token (disabled by default; enable as needed).

Configuration Migration

Supports one-click import and export of full workspace configurations, including monitoring views, alert policies, data processing rules, role management settings, and data compliance.

Expand to view specific resource items
  • Dashboards
  • Custom Explorers
  • Monitor Configurations
  • Data Forwarding Rules
  • Alert Policies
  • Notification Targets
  • SLOs
  • Security Check Rules
  • Log Indices (excluding external indices)
  • Attribute Claims
  • Field Management
  • Global Tags
  • Environment Variables (excluding RUM)
  • Role Management
  • Deny List
  • Pipelines
  • Regular Expressions
  • Field Display Permissions
  • Sensitive Data Scanning

  • Click Export to download an archive containing all relevant configurations of the current workspace.

  • Click Import to upload a JSON file or archive. If resources with the same name are detected, the system provides the following handling options:

    • Skip: Only create files without duplicate names.
    • Overwrite: Overwrite existing resources based on the imported file names.

Advanced Settings

Click Settings to enter the advanced configuration page:







Security

Invitation Approval

When enabled, invited members require approval by the owner or administrator before joining. If disabled, invited members can directly enter the workspace.

MFA Authentication

When enabled, all members of the workspace must complete MFA binding and authentication, otherwise they cannot access the workspace.

API Key Security Display Policy

Used to uniformly manage the display method of API Keys within the workspace. When enabled, newly created API Keys are displayed only once upon successful creation. After closing the page, the plaintext cannot be viewed. When this policy is disabled, authorized members can view the full key again.

Change Notice
  • Changing the policy only affects API Keys created subsequently. Existing API Keys retain their original display format.
  • Automatically created API Keys are displayed in plaintext.
  • This setting is disabled by default. Only the workspace owner can modify it.

When an API Key is created successfully, a popup displays the complete API Key plaintext once, including the name, API Key, role, creation time, and note. It can be downloaded as a text file (.txt) from the bottom-left corner.

After closing the creation success popup or refreshing the page, the plaintext of this API Key is no longer displayed. The list and detail pages only show "Key visible only at creation."

AI Analysis

Controls the data export permission for AI features within the workspace.

  • Enable: Monitoring data, log snippets, trace data, metric summaries, and other information from this workspace may be transmitted to external large language models (public cloud services) for processing.
  • Disable: AI features are unavailable, and data is not exported.
Note
  • This switch is disabled by default for newly created workspaces.
  • Only the workspace owner can enable or disable it. Non-owners do not see this switch.
  • Before enabling this feature, ensure that your organization's security and compliance policies allow such data export to ensure data security and compliance.
  • Enabling and disabling applies to all AI features simultaneously.

Login IP Allowlist

Restricts the IP sources allowed to log in to the console.

When enabled, only IP addresses in the allowlist can log in normally; other sources are denied.

Allowlist format:

  • Multiple IP addresses must be on separate lines, with one IP or CIDR per line. Up to 1,000 entries.
  • Specific IP address: 192.168.0.1 allows access from that IP.
  • Specific IP range: 192.168.0.0/24 allows access from 192.168.0.1 to 192.168.0.255.
  • All IP addresses: 0.0.0.0/0.
Note

Workspace owners are not affected by this restriction to prevent accidental lockout.

Role IP Allowlist

Based on the global IP allowlist, supports further granular control of login IPs by role. When both the global allowlist and the Role IP allowlist are enabled, different roles can be configured with different allowed IPs or CIDR ranges.

Enforcement rule: If a user matches a role rule, the role rule is applied. If no role rule matches, the global IP allowlist is used. If a user belongs to multiple roles, access is allowed if any matching role rule exists.

Note

When a role is deleted, its corresponding IP rules become invalid automatically.

Data Ingestion IP Allowlist

Restricts the egress IPs allowed to report data. When enabled, only IP addresses in the allowlist can report data normally; other sources are blocked.

Allowlist format:

  • Multiple IP addresses must be on separate lines, with one IP or CIDR per line. Up to 1,000 entries.
  • Specific IP address: 192.168.0.1 allows access from that IP.
  • Specific IP range: 192.168.0.0/24 allows access from 192.168.0.1 to 192.168.0.255.
  • All IP addresses: 0.0.0.0/0.

OpenAPI Access IP Allowlist

Restricts the source IPs allowed to access the workspace's OpenAPI and API Key calls. Only IP addresses in the allowlist are allowed; requests from other sources are blocked and audit logs are recorded.

  1. Go to Manage > Workspace Settings > Security.
  2. Under OpenAPI Access IP Allowlist, click Settings.
  3. Enable the allowlist switch and add allowed IPs or CIDR ranges to the IP list.
  4. Save.

Allowlist format:

  • Multiple IP addresses must be on separate lines, with one IP or CIDR per line. Up to 1,000 entries.
  • Specific IP address: 192.168.0.1 allows access from that IP.
  • Specific IP range: 192.168.0.0/24 allows access from 192.168.0.1 to 192.168.0.255.
  • All IP addresses: 0.0.0.0/0.
Note
  1. When enabled, only IP addresses in the allowlist can access the current workspace's OpenAPI (including API Key calls).
  2. Requests from non-allowlist sources are blocked, and audit logs are recorded.
  3. Workspace owners are not affected by this restriction.

Role IP Allowlist

Based on the global IP allowlist, supports further granular control of OpenAPI access IPs by role. When both the global allowlist and the Role IP allowlist are enabled, different roles can be configured with different allowed IPs or CIDR ranges for API calls.

Enforcement rule: If a user matches a role rule, the role rule is applied. If no role rule matches, the global IP allowlist is used. If a user belongs to multiple roles, access is allowed if any matching role rule exists.

Note
  1. When a role is deleted, its corresponding IP rules become invalid automatically.

Data Access Scope Limit

When enabled, regular members in the current workspace who do not match any data access rule will be unable to view any data corresponding to the data access rules.

Note

Only the Owner and Administrator roles can operate this switch, and they are not affected by this restriction.

Risky Operations

The following operations are irreversible. Please proceed with caution.

Daily Metrics Ingestion Limit

For Commercial Plan workspaces billed by data point count, supports setting a daily limit for metric data point ingestion. When the daily metric data point limit is reached, metric data ingestion stops. It automatically resumes at 00:00 the next day.

Prerequisites

Condition Description
Workspace Type Only available for Commercial Plan workspaces billed by data point count. Workspaces billed by time series need to contact their account manager to adjust the billing model before setting.
Operation Permission Only workspace Owner, Administrator, and roles with Manage > Settings Management permission can operate.

Steps

  1. Go to Manage > Workspace Settings > Risky Operations.
  2. Find Data Point Ingestion Limit and click Settings.

  3. In the popup:

    • Enable the Feature Switch.
    • Enter the Daily Data Point Limit (unit: 10 million data points).
    • Select Notification Targets (Owner is selected by default and cannot be removed; supports multiple workspace members and external email addresses).
    • Click Confirm, then confirm the limit value and impact in the secondary confirmation dialog before saving. When disabling the feature, saving is direct without confirmation.
Cost Reference

Data points are billed based on the total accumulated count within the storage period (daily cost ≈ existing data points ÷ 10 million × unit price). The limit can be estimated approximately:

  • Standard storage: Limit ≈ daily budget ÷ data point unit price ÷ metric storage days.

  • Example: Daily budget ¥200, China region unit price ¥0.2/10 million data points, standard storage 7 days → Limit ≈ 143 million data points/day.

  • For workspaces with long-term storage enabled, it is recommended to reference the actual data point trend in Usage Analysis to set the limit.

Trigger and Notification

Timing Behavior
Daily usage reaches 80% of the limit Email notification to Owner and notification targets (once per day only)
Daily usage reaches 100% of the limit Stop receiving metric data; generate a system event (viewable in Event Center: trigger time, limit value); email notification
00:00 next day Automatically resume receiving; email notification

During Throttling

Only metric data ingestion is stopped. Other data types such as logs, traces, RUM, and events are not affected. Data already ingested before throttling is still queryable normally.

Status Description

The inline status on the page changes with the configuration:

  • Not Set: Feature is not enabled.
  • Set (Daily limit xx data points): Limit configured, threshold not reached today.
  • Triggered (Limit reached today, ingestion stopped): Limit exceeded today, metric data ingestion paused, will resume automatically at 00:00 tomorrow.
Note
  • Email notifications have sending and receiving delays. In high-throughput ingestion scenarios, the daily limit may be reached and ingestion stopped before the warning email is received.
  • This feature only applies to workspaces billed by data point count and cannot control costs for workspaces billed by time series.

Change Data Storage Policy

The system allows the owner to change the data storage policy within the workspace.

  1. Go to Manage > Workspace Settings > Change Data Storage Policy.
  2. Click Change.
  3. Select the desired data storage duration.
  4. Confirm.
Note

After the change, new data will be stored according to the new policy. Historical data is not affected.

Delete Measurement

The system allows owners and administrators to delete a measurement within the workspace.

  1. Go to Manage > Workspace Settings > Delete Specified Measurement.
  2. Select the measurement name from the dropdown (supports fuzzy matching).
  3. Click Confirm to add it to the deletion queue for processing.
Note
  • Only workspace owners and administrators can perform this operation.
  • Once a measurement is deleted, it cannot be recovered. Please proceed with caution.
  • System notification events will be generated when a measurement is deleted, such as a user creating a delete measurement task, the task executing successfully, or the task execution failing.

Delete Resource Catalog

The system allows owners and administrators to delete a specified resource catalog classification or all resource catalogs.

  1. Go to Manage > Workspace Settings > Delete Resource Catalog.
  2. Click Delete Resource Catalog.
  3. Select the deletion method for the resource catalog.

  4. Confirm.

    • Specified Resource Catalog Classification: Only deletes data under the selected classification. Does not delete indices.
    • All Resource Catalogs: Deletes all resource catalog data and indices.

Feedback

Is this page helpful?