windmill-labs/windmill · error · Error

Workspace '${name}' is not defined in wmill.yaml 'workspaces

Error message

Workspace '${name}' is not defined in wmill.yaml 'workspaces'. Add it there (its keys must match protection-rules.yaml).

What it means

Lookup guard in the protection-rules WorkspaceResolver: a workspace key referenced by protection-rules.yaml (or passed via --workspace) is not declared under wmill.yaml's 'workspaces' mapping. The CLI maps logical workspace names to backend ids through wmill.yaml; the input at fault is the workspace name that exists in protection-rules.yaml (or the CLI arg) but has no wmill.yaml entry.

Source

Thrown at cli/src/commands/protection-rules/file.ts:76

      string,
      WorkspaceEntryConfig
    >;
    return new WorkspaceResolver(ws);
  }

  /** Workspace keys declared in wmill.yaml (excludes reserved keys). */
  knownNames(): string[] {
    return getWorkspaceNames(this.workspaces as any);
  }

  has(name: string): boolean {
    return this.knownNames().includes(name);
  }

  /** Backend workspace id (path param) for a key, or throw if unknown. */
  backendId(name: string): string {
    if (!this.has(name)) {
      throw new Error(
        `Workspace '${name}' is not defined in wmill.yaml 'workspaces'. ` +
          `Add it there (its keys must match protection-rules.yaml).`,
      );
    }
    return getEffectiveWorkspaceId(name, this.workspaces[name]);
  }
}

// Point the API client at the backend for a single wmill.yaml workspace key,
// then return the backend workspace id to use as the path param. The backend
// id always comes from the wmill.yaml mapping (the feature's invariant);
// credentials are resolved with the same precedence as every other command:
//
//   1. explicit --base-url + --token  -> used as-is (stateless CI; no profile
//      or wmill.yaml baseUrl required)
//   2. otherwise, the stored profile matching wmill.yaml workspaces.<ws>
//      (its baseUrl + token), with an explicit --token overriding the
//      stored token

View on GitHub (pinned to e474e8803c)

Solutions

1. Add the workspace to wmill.yaml under 'workspaces' with its baseUrl and any defaults
2. Fix the name in protection-rules.yaml so its keys match wmill.yaml exactly (reserved keys excluded)
3. Remove the stale workspace key from protection-rules.yaml if it's no longer managed

When it happens

Trigger: Thrown at cli/src/commands/protection-rules/file.ts:76 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/70b611cafeda1095. Report an issue: GitHub.