published on Friday, Nov 6, 2026 by Pulumi
published on Friday, Nov 6, 2026 by Pulumi
With this resource, you can manage the client profile (application profile) of a tenant. A client profile applies runtime policy to dynamically registered clients, such as clients registered through a Client ID Metadata Document (CIMD). A tenant can have only one client profile; if one already exists, import it instead of creating a new one. Destroying this resource deletes the tenant’s client profile, which immediately removes the governance it applies to all matched clients. The docs recommend preventDestroy, and the resource requires the create:client_profiles, read:client_profiles, update:client_profiles and delete:client_profiles scopes. This feature is available in Early Access only. (EA only)
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as auth0 from "@pulumi/auth0";
// Early Access only. The Management API client needs the create, read, update and delete
// `client_profiles` scopes.
//
// A tenant can have only one client profile. Destroying it removes the governance it applies
// to all matched clients, so protect it from accidental deletion.
// Minimal example.
const minimal = new auth0.ClientProfile("minimal", {name: "Dynamic client profile"});
// Full example.
const full = new auth0.ClientProfile("full", {
applyPolicy: {
externalMetadataType: "cimd",
externalMetadataCreatedBy: "client",
},
clientConfiguration: {
refreshToken: {
tokenLifetime: {
defaultValue: 2592000,
},
idleTokenLifetime: {
defaultValue: 1296000,
},
leeway: {
defaultValue: 0,
},
},
organizationUsage: {
defaultValue: "require",
},
organizationRequireBehavior: {
defaultValue: "pre_login_prompt",
},
organizationDiscoveryMethods: {
defaultValues: [
"email",
"organization_name",
],
},
requireProofOfPossession: {
defaultValue: true,
},
},
name: "Dynamic client profile",
description: "Runtime policy for dynamically registered clients.",
});
import pulumi
import pulumi_auth0 as auth0
# Early Access only. The Management API client needs the create, read, update and delete
# `client_profiles` scopes.
#
# A tenant can have only one client profile. Destroying it removes the governance it applies
# to all matched clients, so protect it from accidental deletion.
# Minimal example.
minimal = auth0.ClientProfile("minimal", name="Dynamic client profile")
# Full example.
full = auth0.ClientProfile("full",
apply_policy={
"external_metadata_type": "cimd",
"external_metadata_created_by": "client",
},
client_configuration={
"refresh_token": {
"token_lifetime": {
"default_value": 2592000,
},
"idle_token_lifetime": {
"default_value": 1296000,
},
"leeway": {
"default_value": 0,
},
},
"organization_usage": {
"default_value": "require",
},
"organization_require_behavior": {
"default_value": "pre_login_prompt",
},
"organization_discovery_methods": {
"default_values": [
"email",
"organization_name",
],
},
"require_proof_of_possession": {
"default_value": True,
},
},
name="Dynamic client profile",
description="Runtime policy for dynamically registered clients.")
package main
import (
"github.com/pulumi/pulumi-auth0/sdk/v3/go/auth0"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// Early Access only. The Management API client needs the create, read, update and delete
// `client_profiles` scopes.
//
// A tenant can have only one client profile. Destroying it removes the governance it applies
// to all matched clients, so protect it from accidental deletion.
// Minimal example.
_, err := auth0.NewClientProfile(ctx, "minimal", &auth0.ClientProfileArgs{
Name: pulumi.String("Dynamic client profile"),
})
if err != nil {
return err
}
// Full example.
_, err = auth0.NewClientProfile(ctx, "full", &auth0.ClientProfileArgs{
ApplyPolicy: &auth0.ClientProfileApplyPolicyArgs{
ExternalMetadataType: pulumi.String("cimd"),
ExternalMetadataCreatedBy: pulumi.String("client"),
},
ClientConfiguration: &auth0.ClientProfileClientConfigurationArgs{
RefreshToken: &auth0.ClientProfileClientConfigurationRefreshTokenArgs{
TokenLifetime: &auth0.ClientProfileClientConfigurationRefreshTokenTokenLifetimeArgs{
DefaultValue: pulumi.Int(2592000),
},
IdleTokenLifetime: &auth0.ClientProfileClientConfigurationRefreshTokenIdleTokenLifetimeArgs{
DefaultValue: pulumi.Int(1296000),
},
Leeway: &auth0.ClientProfileClientConfigurationRefreshTokenLeewayArgs{
DefaultValue: pulumi.Int(0),
},
},
OrganizationUsage: &auth0.ClientProfileClientConfigurationOrganizationUsageArgs{
DefaultValue: pulumi.String("require"),
},
OrganizationRequireBehavior: &auth0.ClientProfileClientConfigurationOrganizationRequireBehaviorArgs{
DefaultValue: pulumi.String("pre_login_prompt"),
},
OrganizationDiscoveryMethods: &auth0.ClientProfileClientConfigurationOrganizationDiscoveryMethodsArgs{
DefaultValues: pulumi.StringArray{
pulumi.String("email"),
pulumi.String("organization_name"),
},
},
RequireProofOfPossession: &auth0.ClientProfileClientConfigurationRequireProofOfPossessionArgs{
DefaultValue: pulumi.Bool(true),
},
},
Name: pulumi.String("Dynamic client profile"),
Description: pulumi.String("Runtime policy for dynamically registered clients."),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Auth0 = Pulumi.Auth0;
return await Deployment.RunAsync(() =>
{
// Early Access only. The Management API client needs the create, read, update and delete
// `client_profiles` scopes.
//
// A tenant can have only one client profile. Destroying it removes the governance it applies
// to all matched clients, so protect it from accidental deletion.
// Minimal example.
var minimal = new Auth0.ClientProfile("minimal", new()
{
Name = "Dynamic client profile",
});
// Full example.
var full = new Auth0.ClientProfile("full", new()
{
ApplyPolicy = new Auth0.Inputs.ClientProfileApplyPolicyArgs
{
ExternalMetadataType = "cimd",
ExternalMetadataCreatedBy = "client",
},
ClientConfiguration = new Auth0.Inputs.ClientProfileClientConfigurationArgs
{
RefreshToken = new Auth0.Inputs.ClientProfileClientConfigurationRefreshTokenArgs
{
TokenLifetime = new Auth0.Inputs.ClientProfileClientConfigurationRefreshTokenTokenLifetimeArgs
{
DefaultValue = 2592000,
},
IdleTokenLifetime = new Auth0.Inputs.ClientProfileClientConfigurationRefreshTokenIdleTokenLifetimeArgs
{
DefaultValue = 1296000,
},
Leeway = new Auth0.Inputs.ClientProfileClientConfigurationRefreshTokenLeewayArgs
{
DefaultValue = 0,
},
},
OrganizationUsage = new Auth0.Inputs.ClientProfileClientConfigurationOrganizationUsageArgs
{
DefaultValue = "require",
},
OrganizationRequireBehavior = new Auth0.Inputs.ClientProfileClientConfigurationOrganizationRequireBehaviorArgs
{
DefaultValue = "pre_login_prompt",
},
OrganizationDiscoveryMethods = new Auth0.Inputs.ClientProfileClientConfigurationOrganizationDiscoveryMethodsArgs
{
DefaultValues = new[]
{
"email",
"organization_name",
},
},
RequireProofOfPossession = new Auth0.Inputs.ClientProfileClientConfigurationRequireProofOfPossessionArgs
{
DefaultValue = true,
},
},
Name = "Dynamic client profile",
Description = "Runtime policy for dynamically registered clients.",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.auth0.ClientProfile;
import com.pulumi.auth0.ClientProfileArgs;
import com.pulumi.auth0.inputs.ClientProfileApplyPolicyArgs;
import com.pulumi.auth0.inputs.ClientProfileClientConfigurationArgs;
import com.pulumi.auth0.inputs.ClientProfileClientConfigurationRefreshTokenArgs;
import com.pulumi.auth0.inputs.ClientProfileClientConfigurationRefreshTokenTokenLifetimeArgs;
import com.pulumi.auth0.inputs.ClientProfileClientConfigurationRefreshTokenIdleTokenLifetimeArgs;
import com.pulumi.auth0.inputs.ClientProfileClientConfigurationRefreshTokenLeewayArgs;
import com.pulumi.auth0.inputs.ClientProfileClientConfigurationOrganizationUsageArgs;
import com.pulumi.auth0.inputs.ClientProfileClientConfigurationOrganizationRequireBehaviorArgs;
import com.pulumi.auth0.inputs.ClientProfileClientConfigurationOrganizationDiscoveryMethodsArgs;
import com.pulumi.auth0.inputs.ClientProfileClientConfigurationRequireProofOfPossessionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
// Early Access only. The Management API client needs the create, read, update and delete
// `client_profiles` scopes.
//
// A tenant can have only one client profile. Destroying it removes the governance it applies
// to all matched clients, so protect it from accidental deletion.
// Minimal example.
var minimal = new ClientProfile("minimal", ClientProfileArgs.builder()
.name("Dynamic client profile")
.build());
// Full example.
var full = new ClientProfile("full", ClientProfileArgs.builder()
.applyPolicy(ClientProfileApplyPolicyArgs.builder()
.externalMetadataType("cimd")
.externalMetadataCreatedBy("client")
.build())
.clientConfiguration(ClientProfileClientConfigurationArgs.builder()
.refreshToken(ClientProfileClientConfigurationRefreshTokenArgs.builder()
.tokenLifetime(ClientProfileClientConfigurationRefreshTokenTokenLifetimeArgs.builder()
.defaultValue(2592000)
.build())
.idleTokenLifetime(ClientProfileClientConfigurationRefreshTokenIdleTokenLifetimeArgs.builder()
.defaultValue(1296000)
.build())
.leeway(ClientProfileClientConfigurationRefreshTokenLeewayArgs.builder()
.defaultValue(0)
.build())
.build())
.organizationUsage(ClientProfileClientConfigurationOrganizationUsageArgs.builder()
.defaultValue("require")
.build())
.organizationRequireBehavior(ClientProfileClientConfigurationOrganizationRequireBehaviorArgs.builder()
.defaultValue("pre_login_prompt")
.build())
.organizationDiscoveryMethods(ClientProfileClientConfigurationOrganizationDiscoveryMethodsArgs.builder()
.defaultValues(
"email",
"organization_name")
.build())
.requireProofOfPossession(ClientProfileClientConfigurationRequireProofOfPossessionArgs.builder()
.defaultValue(true)
.build())
.build())
.name("Dynamic client profile")
.description("Runtime policy for dynamically registered clients.")
.build());
}
}
resources:
# Early Access only. The Management API client needs the create, read, update and delete
# `client_profiles` scopes.
#
# A tenant can have only one client profile. Destroying it removes the governance it applies
# to all matched clients, so protect it from accidental deletion.
# Minimal example.
minimal:
type: auth0:ClientProfile
properties:
name: Dynamic client profile
# Full example.
full:
type: auth0:ClientProfile
properties:
applyPolicy:
externalMetadataType: cimd
externalMetadataCreatedBy: client
clientConfiguration:
refreshToken:
tokenLifetime:
defaultValue: 2.592e+06
idleTokenLifetime:
defaultValue: 1.296e+06
leeway:
defaultValue: 0
organizationUsage:
defaultValue: require
organizationRequireBehavior:
defaultValue: pre_login_prompt
organizationDiscoveryMethods:
defaultValues:
- email
- organization_name
requireProofOfPossession:
defaultValue: true
name: Dynamic client profile
description: Runtime policy for dynamically registered clients.
terraform {
required_providers {
auth0 = {
source = "pulumi/auth0"
}
}
}
# Early Access only. The Management API client needs the create, read, update and delete
# `client_profiles` scopes.
#
# A tenant can have only one client profile. Destroying it removes the governance it applies
# to all matched clients, so protect it from accidental deletion.
# Minimal example.
resource "auth0_client_profile" "minimal" {
lifecycle {
create_before_destroy = true
}
name = "Dynamic client profile"
}
# Full example.
resource "auth0_client_profile" "full" {
lifecycle {
create_before_destroy = true
}
apply_policy {
external_metadata_type = "cimd"
external_metadata_created_by = "client"
}
client_configuration {
refresh_token {
token_lifetime {
default_value = 2592000
}
idle_token_lifetime {
default_value = 1296000
}
leeway {
default_value = 0
}
}
organization_usage {
default_value = "require"
}
organization_require_behavior {
default_value = "pre_login_prompt"
}
organization_discovery_methods {
default_value = ["email", "organization_name"]
}
require_proof_of_possession {
default_value = true
}
}
# 30 days.
# 15 days.
name = "Dynamic client profile"
description = "Runtime policy for dynamically registered clients."
}
Create ClientProfile Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new ClientProfile(name: string, args?: ClientProfileArgs, opts?: CustomResourceOptions);@overload
def ClientProfile(resource_name: str,
args: Optional[ClientProfileArgs] = None,
opts: Optional[ResourceOptions] = None)
@overload
def ClientProfile(resource_name: str,
opts: Optional[ResourceOptions] = None,
apply_policy: Optional[ClientProfileApplyPolicyArgs] = None,
client_configuration: Optional[ClientProfileClientConfigurationArgs] = None,
description: Optional[str] = None,
name: Optional[str] = None)func NewClientProfile(ctx *Context, name string, args *ClientProfileArgs, opts ...ResourceOption) (*ClientProfile, error)public ClientProfile(string name, ClientProfileArgs? args = null, CustomResourceOptions? opts = null)
public ClientProfile(String name, ClientProfileArgs args)
public ClientProfile(String name, ClientProfileArgs args, CustomResourceOptions options)
type: auth0:ClientProfile
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "auth0_client_profile" "name" {
# resource properties
}Parameters
- name string
- The unique name of the resource.
- args ClientProfileArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args ClientProfileArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args ClientProfileArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args ClientProfileArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args ClientProfileArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var clientProfileResource = new Auth0.ClientProfile("clientProfileResource", new()
{
ApplyPolicy = new Auth0.Inputs.ClientProfileApplyPolicyArgs
{
ExternalMetadataCreatedBy = "string",
ExternalMetadataType = "string",
},
ClientConfiguration = new Auth0.Inputs.ClientProfileClientConfigurationArgs
{
OrganizationDiscoveryMethods = new Auth0.Inputs.ClientProfileClientConfigurationOrganizationDiscoveryMethodsArgs
{
DefaultValues = new[]
{
"string",
},
},
OrganizationRequireBehavior = new Auth0.Inputs.ClientProfileClientConfigurationOrganizationRequireBehaviorArgs
{
DefaultValue = "string",
},
OrganizationUsage = new Auth0.Inputs.ClientProfileClientConfigurationOrganizationUsageArgs
{
DefaultValue = "string",
},
RefreshToken = new Auth0.Inputs.ClientProfileClientConfigurationRefreshTokenArgs
{
IdleTokenLifetime = new Auth0.Inputs.ClientProfileClientConfigurationRefreshTokenIdleTokenLifetimeArgs
{
DefaultValue = 0,
},
Leeway = new Auth0.Inputs.ClientProfileClientConfigurationRefreshTokenLeewayArgs
{
DefaultValue = 0,
},
TokenLifetime = new Auth0.Inputs.ClientProfileClientConfigurationRefreshTokenTokenLifetimeArgs
{
DefaultValue = 0,
},
},
RequireProofOfPossession = new Auth0.Inputs.ClientProfileClientConfigurationRequireProofOfPossessionArgs
{
DefaultValue = false,
},
},
Description = "string",
Name = "string",
});
example, err := auth0.NewClientProfile(ctx, "clientProfileResource", &auth0.ClientProfileArgs{
ApplyPolicy: &auth0.ClientProfileApplyPolicyArgs{
ExternalMetadataCreatedBy: pulumi.String("string"),
ExternalMetadataType: pulumi.String("string"),
},
ClientConfiguration: &auth0.ClientProfileClientConfigurationArgs{
OrganizationDiscoveryMethods: &auth0.ClientProfileClientConfigurationOrganizationDiscoveryMethodsArgs{
DefaultValues: pulumi.StringArray{
pulumi.String("string"),
},
},
OrganizationRequireBehavior: &auth0.ClientProfileClientConfigurationOrganizationRequireBehaviorArgs{
DefaultValue: pulumi.String("string"),
},
OrganizationUsage: &auth0.ClientProfileClientConfigurationOrganizationUsageArgs{
DefaultValue: pulumi.String("string"),
},
RefreshToken: &auth0.ClientProfileClientConfigurationRefreshTokenArgs{
IdleTokenLifetime: &auth0.ClientProfileClientConfigurationRefreshTokenIdleTokenLifetimeArgs{
DefaultValue: pulumi.Int(0),
},
Leeway: &auth0.ClientProfileClientConfigurationRefreshTokenLeewayArgs{
DefaultValue: pulumi.Int(0),
},
TokenLifetime: &auth0.ClientProfileClientConfigurationRefreshTokenTokenLifetimeArgs{
DefaultValue: pulumi.Int(0),
},
},
RequireProofOfPossession: &auth0.ClientProfileClientConfigurationRequireProofOfPossessionArgs{
DefaultValue: pulumi.Bool(false),
},
},
Description: pulumi.String("string"),
Name: pulumi.String("string"),
})
resource "auth0_client_profile" "clientProfileResource" {
lifecycle {
create_before_destroy = true
}
apply_policy = {
external_metadata_created_by = "string"
external_metadata_type = "string"
}
client_configuration = {
organization_discovery_methods = {
default_values = ["string"]
}
organization_require_behavior = {
default_value = "string"
}
organization_usage = {
default_value = "string"
}
refresh_token = {
idle_token_lifetime = {
default_value = 0
}
leeway = {
default_value = 0
}
token_lifetime = {
default_value = 0
}
}
require_proof_of_possession = {
default_value = false
}
}
description = "string"
name = "string"
}
var clientProfileResource = new ClientProfile("clientProfileResource", ClientProfileArgs.builder()
.applyPolicy(ClientProfileApplyPolicyArgs.builder()
.externalMetadataCreatedBy("string")
.externalMetadataType("string")
.build())
.clientConfiguration(ClientProfileClientConfigurationArgs.builder()
.organizationDiscoveryMethods(ClientProfileClientConfigurationOrganizationDiscoveryMethodsArgs.builder()
.defaultValues("string")
.build())
.organizationRequireBehavior(ClientProfileClientConfigurationOrganizationRequireBehaviorArgs.builder()
.defaultValue("string")
.build())
.organizationUsage(ClientProfileClientConfigurationOrganizationUsageArgs.builder()
.defaultValue("string")
.build())
.refreshToken(ClientProfileClientConfigurationRefreshTokenArgs.builder()
.idleTokenLifetime(ClientProfileClientConfigurationRefreshTokenIdleTokenLifetimeArgs.builder()
.defaultValue(0)
.build())
.leeway(ClientProfileClientConfigurationRefreshTokenLeewayArgs.builder()
.defaultValue(0)
.build())
.tokenLifetime(ClientProfileClientConfigurationRefreshTokenTokenLifetimeArgs.builder()
.defaultValue(0)
.build())
.build())
.requireProofOfPossession(ClientProfileClientConfigurationRequireProofOfPossessionArgs.builder()
.defaultValue(false)
.build())
.build())
.description("string")
.name("string")
.build());
client_profile_resource = auth0.ClientProfile("clientProfileResource",
apply_policy={
"external_metadata_created_by": "string",
"external_metadata_type": "string",
},
client_configuration={
"organization_discovery_methods": {
"default_values": ["string"],
},
"organization_require_behavior": {
"default_value": "string",
},
"organization_usage": {
"default_value": "string",
},
"refresh_token": {
"idle_token_lifetime": {
"default_value": 0,
},
"leeway": {
"default_value": 0,
},
"token_lifetime": {
"default_value": 0,
},
},
"require_proof_of_possession": {
"default_value": False,
},
},
description="string",
name="string")
const clientProfileResource = new auth0.ClientProfile("clientProfileResource", {
applyPolicy: {
externalMetadataCreatedBy: "string",
externalMetadataType: "string",
},
clientConfiguration: {
organizationDiscoveryMethods: {
defaultValues: ["string"],
},
organizationRequireBehavior: {
defaultValue: "string",
},
organizationUsage: {
defaultValue: "string",
},
refreshToken: {
idleTokenLifetime: {
defaultValue: 0,
},
leeway: {
defaultValue: 0,
},
tokenLifetime: {
defaultValue: 0,
},
},
requireProofOfPossession: {
defaultValue: false,
},
},
description: "string",
name: "string",
});
type: auth0:ClientProfile
properties:
applyPolicy:
externalMetadataCreatedBy: string
externalMetadataType: string
clientConfiguration:
organizationDiscoveryMethods:
defaultValues:
- string
organizationRequireBehavior:
defaultValue: string
organizationUsage:
defaultValue: string
refreshToken:
idleTokenLifetime:
defaultValue: 0
leeway:
defaultValue: 0
tokenLifetime:
defaultValue: 0
requireProofOfPossession:
defaultValue: false
description: string
name: string
ClientProfile Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The ClientProfile resource accepts the following input properties:
- Apply
Policy ClientProfile Apply Policy - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- Client
Configuration ClientProfile Client Configuration - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- Description string
- The description of the client profile. Removing the attribute clears the description in Auth0.
- Name string
- The name of the client profile.
- Apply
Policy ClientProfile Apply Policy Args - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- Client
Configuration ClientProfile Client Configuration Args - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- Description string
- The description of the client profile. Removing the attribute clears the description in Auth0.
- Name string
- The name of the client profile.
- apply_
policy object - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- client_
configuration object - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- description string
- The description of the client profile. Removing the attribute clears the description in Auth0.
- name string
- The name of the client profile.
- apply
Policy ClientProfile Apply Policy - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- client
Configuration ClientProfile Client Configuration - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- description String
- The description of the client profile. Removing the attribute clears the description in Auth0.
- name String
- The name of the client profile.
- apply
Policy ClientProfile Apply Policy - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- client
Configuration ClientProfile Client Configuration - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- description string
- The description of the client profile. Removing the attribute clears the description in Auth0.
- name string
- The name of the client profile.
- apply_
policy ClientProfile Apply Policy Args - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- client_
configuration ClientProfile Client Configuration Args - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- description str
- The description of the client profile. Removing the attribute clears the description in Auth0.
- name str
- The name of the client profile.
- apply
Policy Property Map - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- client
Configuration Property Map - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- description String
- The description of the client profile. Removing the attribute clears the description in Auth0.
- name String
- The name of the client profile.
Outputs
All input properties are implicitly available as output properties. Additionally, the ClientProfile resource produces the following output properties:
- created_
at string - The ISO 8601 formatted date the client profile was created.
- id string
- The provider-assigned unique ID for this managed resource.
- updated_
at string - The ISO 8601 formatted date the client profile was updated.
- created_
at str - The ISO 8601 formatted date the client profile was created.
- id str
- The provider-assigned unique ID for this managed resource.
- updated_
at str - The ISO 8601 formatted date the client profile was updated.
Look up Existing ClientProfile Resource
Get an existing ClientProfile resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: ClientProfileState, opts?: CustomResourceOptions): ClientProfile@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
apply_policy: Optional[ClientProfileApplyPolicyArgs] = None,
client_configuration: Optional[ClientProfileClientConfigurationArgs] = None,
created_at: Optional[str] = None,
description: Optional[str] = None,
name: Optional[str] = None,
updated_at: Optional[str] = None) -> ClientProfilefunc GetClientProfile(ctx *Context, name string, id IDInput, state *ClientProfileState, opts ...ResourceOption) (*ClientProfile, error)public static ClientProfile Get(string name, Input<string> id, ClientProfileState? state, CustomResourceOptions? opts = null)public static ClientProfile get(String name, Output<String> id, ClientProfileState state, CustomResourceOptions options)resources: _: type: auth0:ClientProfile get: id: ${id}import {
to = auth0_client_profile.example
id = "${id}"
}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Apply
Policy ClientProfile Apply Policy - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- Client
Configuration ClientProfile Client Configuration - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- Created
At string - The ISO 8601 formatted date the client profile was created.
- Description string
- The description of the client profile. Removing the attribute clears the description in Auth0.
- Name string
- The name of the client profile.
- Updated
At string - The ISO 8601 formatted date the client profile was updated.
- Apply
Policy ClientProfile Apply Policy Args - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- Client
Configuration ClientProfile Client Configuration Args - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- Created
At string - The ISO 8601 formatted date the client profile was created.
- Description string
- The description of the client profile. Removing the attribute clears the description in Auth0.
- Name string
- The name of the client profile.
- Updated
At string - The ISO 8601 formatted date the client profile was updated.
- apply_
policy object - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- client_
configuration object - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- created_
at string - The ISO 8601 formatted date the client profile was created.
- description string
- The description of the client profile. Removing the attribute clears the description in Auth0.
- name string
- The name of the client profile.
- updated_
at string - The ISO 8601 formatted date the client profile was updated.
- apply
Policy ClientProfile Apply Policy - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- client
Configuration ClientProfile Client Configuration - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- created
At String - The ISO 8601 formatted date the client profile was created.
- description String
- The description of the client profile. Removing the attribute clears the description in Auth0.
- name String
- The name of the client profile.
- updated
At String - The ISO 8601 formatted date the client profile was updated.
- apply
Policy ClientProfile Apply Policy - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- client
Configuration ClientProfile Client Configuration - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- created
At string - The ISO 8601 formatted date the client profile was created.
- description string
- The description of the client profile. Removing the attribute clears the description in Auth0.
- name string
- The name of the client profile.
- updated
At string - The ISO 8601 formatted date the client profile was updated.
- apply_
policy ClientProfile Apply Policy Args - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- client_
configuration ClientProfile Client Configuration Args - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- created_
at str - The ISO 8601 formatted date the client profile was created.
- description str
- The description of the client profile. Removing the attribute clears the description in Auth0.
- name str
- The name of the client profile.
- updated_
at str - The ISO 8601 formatted date the client profile was updated.
- apply
Policy Property Map - Runtime matching rules that determine which clients this profile governs. Defaults to dynamically registered CIMD clients.
- client
Configuration Property Map - Runtime policy applied to matched clients. Omitted settings fall back to each client's own setting. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- created
At String - The ISO 8601 formatted date the client profile was created.
- description String
- The description of the client profile. Removing the attribute clears the description in Auth0.
- name String
- The name of the client profile.
- updated
At String - The ISO 8601 formatted date the client profile was updated.
Supporting Types
ClientProfileApplyPolicy, ClientProfileApplyPolicyArgs
- External
Metadata stringCreated By - The creator of the clients to match. Defaults to
client, which means the client was registered dynamically. Possible values: [client]. - External
Metadata stringType - The type of external metadata of the clients to match. Defaults to
cimd. Possible values: [cimd].
- External
Metadata stringCreated By - The creator of the clients to match. Defaults to
client, which means the client was registered dynamically. Possible values: [client]. - External
Metadata stringType - The type of external metadata of the clients to match. Defaults to
cimd. Possible values: [cimd].
- external_
metadata_ stringcreated_ by - The creator of the clients to match. Defaults to
client, which means the client was registered dynamically. Possible values: [client]. - external_
metadata_ stringtype - The type of external metadata of the clients to match. Defaults to
cimd. Possible values: [cimd].
- external
Metadata StringCreated By - The creator of the clients to match. Defaults to
client, which means the client was registered dynamically. Possible values: [client]. - external
Metadata StringType - The type of external metadata of the clients to match. Defaults to
cimd. Possible values: [cimd].
- external
Metadata stringCreated By - The creator of the clients to match. Defaults to
client, which means the client was registered dynamically. Possible values: [client]. - external
Metadata stringType - The type of external metadata of the clients to match. Defaults to
cimd. Possible values: [cimd].
- external_
metadata_ strcreated_ by - The creator of the clients to match. Defaults to
client, which means the client was registered dynamically. Possible values: [client]. - external_
metadata_ strtype - The type of external metadata of the clients to match. Defaults to
cimd. Possible values: [cimd].
- external
Metadata StringCreated By - The creator of the clients to match. Defaults to
client, which means the client was registered dynamically. Possible values: [client]. - external
Metadata StringType - The type of external metadata of the clients to match. Defaults to
cimd. Possible values: [cimd].
ClientProfileClientConfiguration, ClientProfileClientConfigurationArgs
- Organization
Discovery ClientMethods Profile Client Configuration Organization Discovery Methods - Methods used to discover the organization during login. Requires the
organizationRequireBehaviordefault value to bepreLoginPrompt. - Organization
Require ClientBehavior Profile Client Configuration Organization Require Behavior - Defines how to proceed during an authentication transaction when the organization usage is
require. - Organization
Usage ClientProfile Client Configuration Organization Usage - Whether matched clients can use organizations.
- Refresh
Token ClientProfile Client Configuration Refresh Token - Refresh token settings applied to matched clients. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- Require
Proof ClientOf Possession Profile Client Configuration Require Proof Of Possession - Whether matched clients must use proof of possession (DPoP) for their tokens.
- Organization
Discovery ClientMethods Profile Client Configuration Organization Discovery Methods - Methods used to discover the organization during login. Requires the
organizationRequireBehaviordefault value to bepreLoginPrompt. - Organization
Require ClientBehavior Profile Client Configuration Organization Require Behavior - Defines how to proceed during an authentication transaction when the organization usage is
require. - Organization
Usage ClientProfile Client Configuration Organization Usage - Whether matched clients can use organizations.
- Refresh
Token ClientProfile Client Configuration Refresh Token - Refresh token settings applied to matched clients. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- Require
Proof ClientOf Possession Profile Client Configuration Require Proof Of Possession - Whether matched clients must use proof of possession (DPoP) for their tokens.
- organization_
discovery_ objectmethods - Methods used to discover the organization during login. Requires the
organizationRequireBehaviordefault value to bepreLoginPrompt. - organization_
require_ objectbehavior - Defines how to proceed during an authentication transaction when the organization usage is
require. - organization_
usage object - Whether matched clients can use organizations.
- refresh_
token object - Refresh token settings applied to matched clients. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- require_
proof_ objectof_ possession - Whether matched clients must use proof of possession (DPoP) for their tokens.
- organization
Discovery ClientMethods Profile Client Configuration Organization Discovery Methods - Methods used to discover the organization during login. Requires the
organizationRequireBehaviordefault value to bepreLoginPrompt. - organization
Require ClientBehavior Profile Client Configuration Organization Require Behavior - Defines how to proceed during an authentication transaction when the organization usage is
require. - organization
Usage ClientProfile Client Configuration Organization Usage - Whether matched clients can use organizations.
- refresh
Token ClientProfile Client Configuration Refresh Token - Refresh token settings applied to matched clients. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- require
Proof ClientOf Possession Profile Client Configuration Require Proof Of Possession - Whether matched clients must use proof of possession (DPoP) for their tokens.
- organization
Discovery ClientMethods Profile Client Configuration Organization Discovery Methods - Methods used to discover the organization during login. Requires the
organizationRequireBehaviordefault value to bepreLoginPrompt. - organization
Require ClientBehavior Profile Client Configuration Organization Require Behavior - Defines how to proceed during an authentication transaction when the organization usage is
require. - organization
Usage ClientProfile Client Configuration Organization Usage - Whether matched clients can use organizations.
- refresh
Token ClientProfile Client Configuration Refresh Token - Refresh token settings applied to matched clients. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- require
Proof ClientOf Possession Profile Client Configuration Require Proof Of Possession - Whether matched clients must use proof of possession (DPoP) for their tokens.
- organization_
discovery_ Clientmethods Profile Client Configuration Organization Discovery Methods - Methods used to discover the organization during login. Requires the
organizationRequireBehaviordefault value to bepreLoginPrompt. - organization_
require_ Clientbehavior Profile Client Configuration Organization Require Behavior - Defines how to proceed during an authentication transaction when the organization usage is
require. - organization_
usage ClientProfile Client Configuration Organization Usage - Whether matched clients can use organizations.
- refresh_
token ClientProfile Client Configuration Refresh Token - Refresh token settings applied to matched clients. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- require_
proof_ Clientof_ possession Profile Client Configuration Require Proof Of Possession - Whether matched clients must use proof of possession (DPoP) for their tokens.
- organization
Discovery Property MapMethods - Methods used to discover the organization during login. Requires the
organizationRequireBehaviordefault value to bepreLoginPrompt. - organization
Require Property MapBehavior - Defines how to proceed during an authentication transaction when the organization usage is
require. - organization
Usage Property Map - Whether matched clients can use organizations.
- refresh
Token Property Map - Refresh token settings applied to matched clients. Auth0 replaces this block as a whole, so removing it clears all of its settings.
- require
Proof Property MapOf Possession - Whether matched clients must use proof of possession (DPoP) for their tokens.
ClientProfileClientConfigurationOrganizationDiscoveryMethods, ClientProfileClientConfigurationOrganizationDiscoveryMethodsArgs
- Default
Values List<string> - Possible values: [email organizationName].
- Default
Values []string - Possible values: [email organizationName].
- default_
values list(string) - Possible values: [email organizationName].
- default
Values List<String> - Possible values: [email organizationName].
- default
Values string[] - Possible values: [email organizationName].
- default_
values Sequence[str] - Possible values: [email organizationName].
- default
Values List<String> - Possible values: [email organizationName].
ClientProfileClientConfigurationOrganizationRequireBehavior, ClientProfileClientConfigurationOrganizationRequireBehaviorArgs
- Default
Value string - Possible values: [noprompt preloginprompt postlogin_prompt].
- Default
Value string - Possible values: [noprompt preloginprompt postlogin_prompt].
- default_
value string - Possible values: [noprompt preloginprompt postlogin_prompt].
- default
Value String - Possible values: [noprompt preloginprompt postlogin_prompt].
- default
Value string - Possible values: [noprompt preloginprompt postlogin_prompt].
- default_
value str - Possible values: [noprompt preloginprompt postlogin_prompt].
- default
Value String - Possible values: [noprompt preloginprompt postlogin_prompt].
ClientProfileClientConfigurationOrganizationUsage, ClientProfileClientConfigurationOrganizationUsageArgs
- Default
Value string - Possible values: [deny allow require].
- Default
Value string - Possible values: [deny allow require].
- default_
value string - Possible values: [deny allow require].
- default
Value String - Possible values: [deny allow require].
- default
Value string - Possible values: [deny allow require].
- default_
value str - Possible values: [deny allow require].
- default
Value String - Possible values: [deny allow require].
ClientProfileClientConfigurationRefreshToken, ClientProfileClientConfigurationRefreshTokenArgs
- Idle
Token ClientLifetime Profile Client Configuration Refresh Token Idle Token Lifetime - The inactivity lifetime of a refresh token. It must not exceed
tokenLifetime. If only one oftokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other. - Leeway
Client
Profile Client Configuration Refresh Token Leeway - The period in which a refresh token may be reused without triggering reuse detection.
- Token
Lifetime ClientProfile Client Configuration Refresh Token Token Lifetime - The absolute lifetime of a refresh token. If only one of
tokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other.
- Idle
Token ClientLifetime Profile Client Configuration Refresh Token Idle Token Lifetime - The inactivity lifetime of a refresh token. It must not exceed
tokenLifetime. If only one oftokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other. - Leeway
Client
Profile Client Configuration Refresh Token Leeway - The period in which a refresh token may be reused without triggering reuse detection.
- Token
Lifetime ClientProfile Client Configuration Refresh Token Token Lifetime - The absolute lifetime of a refresh token. If only one of
tokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other.
- idle_
token_ objectlifetime - The inactivity lifetime of a refresh token. It must not exceed
tokenLifetime. If only one oftokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other. - leeway object
- The period in which a refresh token may be reused without triggering reuse detection.
- token_
lifetime object - The absolute lifetime of a refresh token. If only one of
tokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other.
- idle
Token ClientLifetime Profile Client Configuration Refresh Token Idle Token Lifetime - The inactivity lifetime of a refresh token. It must not exceed
tokenLifetime. If only one oftokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other. - leeway
Client
Profile Client Configuration Refresh Token Leeway - The period in which a refresh token may be reused without triggering reuse detection.
- token
Lifetime ClientProfile Client Configuration Refresh Token Token Lifetime - The absolute lifetime of a refresh token. If only one of
tokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other.
- idle
Token ClientLifetime Profile Client Configuration Refresh Token Idle Token Lifetime - The inactivity lifetime of a refresh token. It must not exceed
tokenLifetime. If only one oftokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other. - leeway
Client
Profile Client Configuration Refresh Token Leeway - The period in which a refresh token may be reused without triggering reuse detection.
- token
Lifetime ClientProfile Client Configuration Refresh Token Token Lifetime - The absolute lifetime of a refresh token. If only one of
tokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other.
- idle_
token_ Clientlifetime Profile Client Configuration Refresh Token Idle Token Lifetime - The inactivity lifetime of a refresh token. It must not exceed
tokenLifetime. If only one oftokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other. - leeway
Client
Profile Client Configuration Refresh Token Leeway - The period in which a refresh token may be reused without triggering reuse detection.
- token_
lifetime ClientProfile Client Configuration Refresh Token Token Lifetime - The absolute lifetime of a refresh token. If only one of
tokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other.
- idle
Token Property MapLifetime - The inactivity lifetime of a refresh token. It must not exceed
tokenLifetime. If only one oftokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other. - leeway Property Map
- The period in which a refresh token may be reused without triggering reuse detection.
- token
Lifetime Property Map - The absolute lifetime of a refresh token. If only one of
tokenLifetimeandidleTokenLifetimeis set, Auth0 derives the other.
ClientProfileClientConfigurationRefreshTokenIdleTokenLifetime, ClientProfileClientConfigurationRefreshTokenIdleTokenLifetimeArgs
- Default
Value int - The lifetime in seconds.
- Default
Value int - The lifetime in seconds.
- default_
value number - The lifetime in seconds.
- default
Value Integer - The lifetime in seconds.
- default
Value number - The lifetime in seconds.
- default_
value int - The lifetime in seconds.
- default
Value Number - The lifetime in seconds.
ClientProfileClientConfigurationRefreshTokenLeeway, ClientProfileClientConfigurationRefreshTokenLeewayArgs
- Default
Value int - The leeway in seconds.
0disables the leeway.
- Default
Value int - The leeway in seconds.
0disables the leeway.
- default_
value number - The leeway in seconds.
0disables the leeway.
- default
Value Integer - The leeway in seconds.
0disables the leeway.
- default
Value number - The leeway in seconds.
0disables the leeway.
- default_
value int - The leeway in seconds.
0disables the leeway.
- default
Value Number - The leeway in seconds.
0disables the leeway.
ClientProfileClientConfigurationRefreshTokenTokenLifetime, ClientProfileClientConfigurationRefreshTokenTokenLifetimeArgs
- Default
Value int - The lifetime in seconds.
- Default
Value int - The lifetime in seconds.
- default_
value number - The lifetime in seconds.
- default
Value Integer - The lifetime in seconds.
- default
Value number - The lifetime in seconds.
- default_
value int - The lifetime in seconds.
- default
Value Number - The lifetime in seconds.
ClientProfileClientConfigurationRequireProofOfPossession, ClientProfileClientConfigurationRequireProofOfPossessionArgs
- Default
Value bool - Whether proof of possession is required.
- Default
Value bool - Whether proof of possession is required.
- default_
value bool - Whether proof of possession is required.
- default
Value Boolean - Whether proof of possession is required.
- default
Value boolean - Whether proof of possession is required.
- default_
value bool - Whether proof of possession is required.
- default
Value Boolean - Whether proof of possession is required.
Import
A client profile can be imported using its ID.
You can find the existing client profile ID using the Auth0 Management API. https://auth0.com/docs/api/management/v2#!/Client_Profiles/get_client_profiles
Example:
$ pulumi import auth0:index/clientProfile:ClientProfile full "cpr_XXXXXXXXXXXXXXXX"
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Auth0 pulumi/pulumi-auth0
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
auth0Terraform Provider.
published on Friday, Nov 6, 2026 by Pulumi