#Workspaces

A workspace is the security and collaboration boundary in Legra. Each workspace has its own encryption key, set of members, and collection of branches. All data in a workspace is end-to-end encrypted — only members with the workspace key can read or write.

#Creating a workspace

legra workspace create --name "My Project"

This generates a new workspace with a unique ID (urn:legra:workspace:<uuid>), creates an encryption key, and sets you as the owner.

#Listing workspaces

legra workspace list

#Viewing workspace details

legra workspace info <workspace-id>

#Switching workspaces

Set the active workspace for subsequent commands:

legra workspace use <workspace-id>

Check which workspace is currently active:

legra workspace current

#Membership roles

Each workspace member has one of four roles:

#Inviting members

Invite a member by their identity:

legra workspace invite <workspace-id> --identity <member-identity> --role Writer

The invited member must accept the invitation:

legra workspace accept-invite <workspace-id>

Or decline it:

legra workspace decline-invite <workspace-id>

#Managing members

List all members:

legra workspace members <workspace-id>

Suspend a member (temporarily revoke access without removing them):

legra workspace suspend <workspace-id> --identity <member-identity>

Reactivate a suspended member:

legra workspace reactivate <workspace-id> --identity <member-identity>

Revoke a member permanently (the workspace encryption key is automatically regenerated so the revoked member cannot read future data):

legra workspace revoke <workspace-id> --identity <member-identity>

#Access revocation

When a member is revoked, Legra automatically generates a new encryption key for the workspace so that the removed person cannot read future data. Historical data that was written before the revocation remains accessible to anyone who was a member at the time.

You can also trigger this manually as the owner:

legra workspace rotate-key <workspace-id>

#The root workspace

When you initialize a node with legra install --apt --node-only, a default workspace is created automatically. This is the root workspace — it holds the node’s identity information and serves as the default target for commands when no workspace is specified.

#Deleting a workspace

Only the owner can delete a workspace:

legra workspace delete <workspace-id>

This removes the workspace and all its local data.