# spin team

**Spinbox is experimental: APIs change and data may be lost.** What is built and what proves it is on [Status](https://spin-stack.github.io/website/reference/status.md); what Spinbox does not do is on [Limitations](https://spin-stack.github.io/website/overview/limitations.md).

> spin team: Manage teams.

<!-- Generated by tools/refgen from spin:cmd/cli. Edit the source, not this file. -->

```
Manage teams and team membership.

Teams provide hierarchical grouping of users and workspaces. Teams can be
nested up to 3 levels deep (e.g., /engineering/backend/api).

Usage:
  spin team [flags]
  spin team [command]

Available Commands:
  create      Create a new team
  delete      Delete a team
  forge       Manage the app a team's workspaces reach its repositories with
  get         Get team details
  list        List teams
  member      Manage team members
  policy      Manage the network policies a team's workspaces may run under
  secret      Manage the secrets the egress proxy adds for a team's workspaces

Flags:
  -h, --help   help for team

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

Use "spin team [command] --help" for more information about a command.
```

### spin team create

```
Create a new team. Use --parent to nest under an existing team.

Examples:
  spin team create engineering
  spin team create backend --parent engineering
  spin team create api --parent /engineering/backend

Usage:
  spin team create <name> [flags]

Flags:
      --description string   Team description
  -h, --help                 help for create
      --parent string        Parent team ID or path
      --slug string          URL-friendly slug (auto-generated if empty)

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin team delete

```
Delete a team. Only team owners can delete teams.
Teams with children cannot be deleted unless --recursive is used.

Usage:
  spin team delete <team> [flags]

Flags:
  -h, --help        help for delete
      --recursive   Delete children too (dangerous!)
  -y, --yes         Skip confirmation

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin team forge

```
A team's forge is the app it installed on its organization - a GitHub App, today. The control
plane keeps the app's key and mints an installation token with it, an hour's, for the egress
proxy of a host a workspace of the team runs on; a brokered network rule that injects the forge
has the proxy set it on the workspace's requests to the forge. A workspace clones and pushes the
team's private repositories with nothing of either on its disk, so nothing of either is in a
snapshot of it. A workspace of a sub-team uses the nearest of its teams that has one.

Usage:
  spin team forge [flags]
  spin team forge [command]

Available Commands:
  delete      Delete a team's forge app
  list        List a team's forge apps
  set         Set a team's app on a forge: github, its GitHub App

Flags:
  -h, --help   help for forge

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

Use "spin team forge [command] --help" for more information about a command.
```

#### spin team forge delete

```
Delete a team's forge app

Usage:
  spin team forge delete <team> <forge> [flags]

Flags:
  -h, --help   help for delete
  -y, --yes    Skip confirmation

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

#### spin team forge list

```
List a team's forge apps

Usage:
  spin team forge list <team> [flags]

Flags:
  -h, --help   help for list

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

#### spin team forge set

```
Set the team's GitHub App: its id, its installation on the organization the team's
repositories are in, and its private key, read from a file (as GitHub hands it over) or from
standard input with --private-key-file -. Never an argument: an argument is in every process
listing on the machine. The control plane tries the app before keeping it: an id, an
installation or a key GitHub refuses is said here. The token goes to github.com and
api.github.com unless --host names where; a brokered rule that injects the forge and names any
other host is refused it.

Example:
  spin team forge set engineering github --app-id 123456 --installation-id 7890123 \
    --private-key-file ~/Downloads/engineering.2026-10-15.private-key.pem

Usage:
  spin team forge set <team> <forge> [flags]

Flags:
      --api-url string            The forge's API, for GitHub Enterprise Server: https://<host>/api/v3
      --app-id int                The app's id, on its settings page
  -h, --help                      help for set
      --host stringArray          A host the token may be sent to, named exactly (repeatable)
      --installation-id int       The app's installation on the organization, at the end of its URL
      --private-key-file string   The app's private key, PEM; - reads standard input

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin team get

```
Get team details

Usage:
  spin team get <team> [flags]

Flags:
  -h, --help   help for get

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin team list

```
List teams

Usage:
  spin team list [flags]

Flags:
      --all             Include all descendant teams
  -h, --help            help for list
      --parent string   Filter by parent team

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin team member

```
Manage team members

Usage:
  spin team member [flags]
  spin team member [command]

Available Commands:
  add         Add a member to a team
  list        List team members
  remove      Remove a member from a team
  role        Update a member's role

Flags:
  -h, --help   help for member

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

Use "spin team member [command] --help" for more information about a command.
```

#### spin team member add

```
Add a member to a team

Usage:
  spin team member add <team> <email> [flags]

Flags:
  -h, --help          help for add
      --role string   Role: owner, admin, member (default "member")

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

#### spin team member list

```
List team members

Usage:
  spin team member list <team> [flags]

Flags:
  -h, --help   help for list

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

#### spin team member remove

```
Remove a member from a team

Usage:
  spin team member remove <team> <user-id> [flags]

Flags:
  -h, --help   help for remove

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

#### spin team member role

```
Update a member's role

Usage:
  spin team member role <team> <user-id> <role> [flags]

Flags:
  -h, --help   help for role

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin team policy

```
A team's network policies are named allowlists, declared by its admins where the
installation lets teams declare them, for the workspaces of the team and of the teams below it.
A workspace runs under one by naming it (spin workspace create --network-tag, spin workspace
retag). They only allow: a brokered rule is the installation's to declare.

Usage:
  spin team policy [flags]
  spin team policy [command]

Available Commands:
  delete      Delete a team's network policy no workspace runs under
  list        List a team's network policies and what each allows
  set         Make a team's policy, or replace what it allows

Flags:
  -h, --help   help for policy

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

Use "spin team policy [command] --help" for more information about a command.
```

#### spin team policy delete

```
Delete a team's network policy no workspace runs under

Usage:
  spin team policy delete <team> <name> [flags]

Flags:
  -h, --help   help for delete
  -y, --yes    Skip confirmation

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

#### spin team policy list

```
List a team's network policies and what each allows

Usage:
  spin team policy list <team> [flags]

Flags:
  -h, --help   help for list

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

#### spin team policy set

```
Make a team's policy, or replace what it allows, whole. Each --rule is destinations, then
the ports they are reached on after a colon: CIDRs or addresses, and names - exact or with one
leading "*." - separated by commas. No ports is every port; no destinations is any destination
on those ports. No --rule at all allows nothing.

Example:
  spin team policy set <team> builds --rule github.com,*.githubusercontent.com:443 --rule 10.20.0.0/16:5432

Usage:
  spin team policy set <team> <name> [flags]

Flags:
  -h, --help               help for set
      --rule stringArray   Destinations and ports, as dest,dest:port,port (repeatable)

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin team secret

```
A team's secrets are what a brokered network rule has the host's egress proxy add to a
request a workspace of the team makes - an API key the workspace uses without ever holding it.
A value is set and replaced, and not shown again; it is sent only to the hosts set with it. A
workspace of a sub-team uses the nearest of its teams that has the name. The installation's
admins, who write the policies, are trusted with it.

Usage:
  spin team secret [flags]
  spin team secret [command]

Available Commands:
  delete      Delete a team's secret
  list        List a team's secrets, by name
  set         Set a team's secret, read from standard input or kept in Secrets Manager or Parameter Store

Flags:
  -h, --help   help for secret

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

Use "spin team secret [command] --help" for more information about a command.
```

#### spin team secret delete

```
Delete a team's secret

Usage:
  spin team secret delete <team> <name> [flags]

Flags:
  -h, --help   help for delete
  -y, --yes    Skip confirmation

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

#### spin team secret list

```
List a team's secrets, by name

Usage:
  spin team secret list <team> [flags]

Flags:
  -h, --help   help for list

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

#### spin team secret set

```
Set a team's secret to what standard input holds, and the hosts it may be sent to, replacing
what the name held. Read from standard input and never an argument: an argument is in every
process listing on the machine. A brokered rule that injects the secret and names any host not
given here is refused it.

With --ref the team keeps the value in Secrets Manager or Parameter Store instead, and the control
plane reads it as the team whenever a host asks: the secret or the parameter must carry the tag
spin-team-id with the team's id. A parameter costs nothing; a SecureString is opened on the read.

Example:
  printf %s "$GITHUB_TOKEN" | spin team secret set engineering github --host api.github.com
  spin team secret set engineering github --host api.github.com \
    --ref arn:aws:secretsmanager:us-east-2:123456789012:secret:github-AbCdEf

Usage:
  spin team secret set <team> <name> [flags]

Flags:
  -h, --help               help for set
      --host stringArray   A host the secret may be sent to, named exactly (repeatable)
      --ref string         The ARN of the Secrets Manager secret or the Parameter Store parameter the team keeps the value in

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```