Workspace Settings¶

Manage > Workspace Settings is the core configuration center of a workspace. Workspace Owners and Administrators can:

• View information such as the workspace version, site, Token, and member scale;
• Export/import Dashboards, Monitors, and other configurations for reuse across workspaces;
• Protect data security through layered mechanisms such as MFA, IP allowlists, and invitation approval;
• Perform irreversible operations such as adjusting storage policies and cleaning historical data.

Basic Information¶

Displays the core information of the current workspace. Only Owners and Administrators can edit.

Workspace Language¶

Supports Simplified Chinese, Traditional Chinese, English, Indonesian, Japanese, and Korean. The workspace language is used for system events and notification templates. The phone broadcast language and metering rules are determined by the saved workspace language:

The metering count is calculated based on the character count of the complete broadcast text after truncation. A portion less than one metering unit is counted as 1. Repeated playback within the same phone call is counted as one text. For detailed rules and examples, see Phone Notification Billing.

Remark¶

Add a remark to the current workspace that is visible only to you.

The remark is displayed together with the workspace name in the upper-left corner for quick identification.

Description¶

Add a description for the current workspace. Once added, it can be viewed directly in the upper-left corner of the workspace for easy identification.

Token¶

Token is the authentication credential for data reporting via DataKit and OpenAPI.

View and Copy¶

Click the copy button to the right of the Token to copy the full secret.

Replace Token¶

Click Replace, set the expiration time for the old Token, and then generate a new Token:

• Make it invalid immediately
• 10 minutes
• 6 hours
• 12 hours
• 24 hours

Edit Token Configuration¶

Click Edit to configure the following:

• Custom Token: Set a custom secret (optional).

• Enable data query: Allow the Token to query platform data (disabled by default; enable only as needed).

Configuration Migration¶

Supports one-click import and export of the complete workspace configuration, covering core resources such as monitoring views, Alert Policies, data processing rules, role management settings, and data compliance.

• Click Export to download an archive containing all related configurations of the current workspace.

• Click Import to upload a JSON file or an archive. If a resource with the same name is detected, the system provides the following handling options:

  • Skip: Only creates resources that do not conflict with existing names;
  • Overwrite: Overwrites and creates the corresponding resources according to the imported file names.

Advanced Settings¶

Click Settings to enter the advanced configuration page:

Phone Broadcast Character Limit¶

The workspace Owner can adjust the phone broadcast character limit under Manage > Workspace Settings > Basic Information > Advanced Settings. If alert titles are too long or key content is missing from the broadcast, increase the limit and evaluate the cost impact using the Phone Notification Billing.

This setting displays and adjusts the broadcast limit of the template corresponding to the current workspace language. After saving, it takes effect for subsequent phone notifications that use that template. After switching the workspace language, the saved limit for the corresponding template is loaded. If no limit has been configured, the default value is used. Switching back to the original template restores the existing configuration.

Restore Default first updates the input field and takes effect after saving.

Fixed scripts and necessary action prompts consume part of the character budget. The remaining characters prioritize the site and workspace name, followed by the alert or incident title. Therefore, the larger the limit, the more title content can be accommodated. The longer the site or workspace name, the fewer characters remain for the title. For overlong variables, the prefix is retained, and segments such as English words, contiguous digits, IPs, and ports are kept intact or truncated as a whole. The actual broadcast length may therefore be shorter than the limit.

Letters, digits, punctuation, and spaces all count toward the character limit. Combined emoji may consist of multiple characters. The limit is calculated based on the complete broadcast text.

Security¶

Invitation Approval¶

When enabled, invited members must be approved by an Owner or Administrator before they can join. When disabled, invited members can enter the workspace directly.

MFA Security Authentication¶

When enabled, all workspace members must complete MFA binding and authentication; otherwise, they cannot access the workspace.

API Key Security Display Policy¶

Used to uniformly manage how API Keys are displayed in the workspace. When enabled, newly created API Keys are displayed only once at creation, and the plaintext cannot be viewed after the page is closed. When this policy is disabled, members with permission can view the full Key again.

After an API Key is created successfully, the dialog displays the full plaintext API Key once, including the name, API Key, role, creation time, and remark. The lower-left corner supports downloading it as a text file (.txt).

After closing the creation success dialog or refreshing the page, the plaintext of the API Key is no longer displayed. The list and details pages only display "Key is visible only at creation".

AI Analytics¶

Controls whether AI features in the workspace may send data externally.

• Enabled: Information from this workspace, such as monitoring data, log snippets, trace data, and metric summaries, may be transmitted to an external large language model (public service) for processing;

• Disabled: AI features are unavailable and no data is sent externally.

Special characters

Login IP Allowlist¶

Restricts the IP sources that can sign in to the console.

When enabled, only allowlisted IPs can sign in normally. All other sources are rejected.

Format for the IP allowlist:

• Multiple IPs must be entered on separate lines. Each line can contain only one IP address or CIDR block, and up to 1,000 entries can be added;
• Single IP address: 192.168.0.1 — allows access from the IP address 192.168.0.1;
• CIDR block: 192.168.0.0/24 — allows access from IP addresses 192.168.0.1 through 192.168.0.255;
• All IP addresses: 0.0.0.0/0.

Role IP Allowlist¶

Based on the global IP allowlist, you can further refine sign-in IP control by role. When both the global allowlist and the Role IP allowlist are enabled, allowed IP addresses or CIDR blocks can be configured separately for different roles.

Effective rule: If a user has a matching role rule, access is determined by the role rule. If no role rule matches, access falls back to the global IP list. If a user belongs to multiple roles, matching any one role rule allows access.

Data Reporting IP Allowlist¶

Restricts the egress IPs that can report data. When enabled, only allowlisted IPs can report data normally. Data from all other sources is blocked.

Format for the IP allowlist:

• Multiple IPs must be entered on separate lines. Each line can contain only one IP address or CIDR block, and up to 1,000 entries can be added;
• Single IP address: 192.168.0.1 — allows data reporting from the IP address 192.168.0.1;
• CIDR block: 192.168.0.0/24 — allows data reporting from IP addresses 192.168.0.1 through 192.168.0.255;
• All IP addresses: 0.0.0.0/0.

OpenAPI Access IP Allowlist¶

Restricts the source IPs for OpenAPI and API Key calls in the current workspace. Only allowlisted IPs are allowed to access. Requests from non-allowlisted sources are blocked and recorded in audit logs.

1. Go to Manage > Workspace Settings > Security;
2. Under OpenAPI access IP allowlist, click Set;
3. Enable the allowlist switch and add the allowed IP addresses or CIDR blocks to the IP list;
4. Save.

Format for the IP allowlist:

• Multiple IPs must be entered on separate lines. Each line can contain only one IP address or CIDR block, and up to 1,000 entries can be added;
• Single IP address: 192.168.0.1 — allows access from that IP address;
• CIDR block: 192.168.0.0/24 — allows access from IP addresses 192.168.0.1 through 192.168.0.255;
• All IP addresses: 0.0.0.0/0.

Role IP Allowlist¶

Based on the global IP allowlist, you can further refine IP control for OpenAPI access by role. When both the global allowlist and the Role IP allowlist are enabled, allowed IP addresses or CIDR blocks can be configured separately for different roles.

Effective rule: If a user has a matching role rule, access is determined by the role rule. If no role rule matches, access falls back to the global IP list. If a user belongs to multiple roles, matching any one role rule allows access.

Data Access Scope Restriction¶

When enabled, regular members in the current workspace who do not match any Data Access rule cannot view any data covered by Data Access rules.

This switch only controls the default access behavior when a member does not match a rule. It does not affect the execution of Data Access rules that are already associated.

Risky Operations¶

The following operations are irreversible. Proceed with caution.

Daily Metrics Reporting Limit¶

Commercial Plan workspaces billed by data point count support setting a daily reporting limit for metric data points. When the daily limit is reached, metric data is no longer accepted and automatically resumes being accepted at 00:00 the next day.

Prerequisites¶

Configuration Steps¶

1. Go to Manage > Workspace Settings > Risky Operations;
2. Locate Data point reporting limit and click Set;

3. In the dialog:

   • Enable the feature switch;
   • Enter the daily data point limit (unit: 10 million data points);
   • Select Notification Targets (the Owner is selected by default and cannot be removed; multiple workspace members and external email addresses can be selected);

4. Click OK, confirm the limit and its impact, and then save. If disabling the feature, save directly without a confirmation dialog.

Trigger and Notification¶

During the Cutoff Period¶

Only metric data ingestion is stopped. Other data types such as logs, traces, RUM, and events are not affected. Data already stored before the cutoff remains queryable.

Status Descriptions¶

The inline status on the page changes according to the configuration:

• Not configured: The feature is not enabled;
• Configured (daily limit xx data points): A limit has been configured, and the threshold has not been reached today;
• Triggered (daily limit reached; ingestion stopped): The daily limit has been exceeded, metric data ingestion is paused, and it will automatically resume at 00:00 the next day.

Change Data Storage Policy¶

Owners can change the data storage policy in the workspace.

For the storage durations available for observability data, see Data Storage Policy.

1. Go to Manage > Workspace Settings > Change Data Storage Policy;
2. Click Change;
3. Select the desired data storage duration;
4. Confirm.

Delete Measurement¶

Owners and Administrators can delete Measurements in the workspace.

1. Go to Manage > Workspace Settings > Delete Specified Measurement;
2. Select the Measurement name from the dropdown (fuzzy matching supported);
3. Click OK, and the Measurement enters the deletion queue and waits for deletion.

Delete Resource Catalog¶

Owners and Administrators can delete a specified Resource Catalog category and all Resource Catalogs.

1. Go to Manage > Workspace Settings > Delete Resource Catalog;
2. Click Delete Resource Catalog;
3. Select a Resource Catalog deletion method;

4. Confirm.

   • Specified Resource Catalog category: Only deletes data under the selected object category. Indexes are not deleted;
   • All Resource Catalogs: Deletes all Resource Catalog data and indexes.