Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Descope Provider
  4. API Docs
  5. ManagementKey
Viewing docs for Descope v0.3.13
published on Tuesday, Jul 14, 2026 by Descope
Schema (JSON)
descope/pulumi-descope

descope.ManagementKey

descope logo
Viewing docs for Descope v0.3.13
published on Tuesday, Jul 14, 2026 by Descope
Schema (JSON)
descope/pulumi-descope

    Manages a Descope Management Key—a credential used to authenticate programmatic access to the Descope Management API and SDKs. Management keys are used for backend operations such as creating users, managing sessions, and building automation pipelines.

    Important: The cleartext attribute (the raw key value) is only available immediately after creation and cannot be retrieved later through the API. Store it securely using a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault) immediately after pulumi up.

    Keys can be scoped to restrict which projects they can access, at the company level or per-project or tag:

    • Company roles – Access to all projects in the company
    • Project roles – Scoped to specific project IDs
    • Tag roles – Scoped to all projects with a given tag

    See the Descope documentation for the list of valid role names.

    Example Usage

    Company-Level Key

    import * as pulumi from "@pulumi/pulumi";
import * as descope from "@descope/pulumi-descope";

const companyKey = new descope.ManagementKey("company_key", {
    name: "CI/CD Pipeline Key",
    description: "Used by the deployment pipeline to manage users",
    rebac: {
        companyRoles: ["<role-name>"],
    },
});
export const managementKeyValue = companyKey.cleartext;

    import pulumi
import descope_pulumi as descope

company_key = descope.ManagementKey("company_key",
    name="CI/CD Pipeline Key",
    description="Used by the deployment pipeline to manage users",
    rebac={
        "company_roles": ["<role-name>"],
    })
pulumi.export("managementKeyValue", company_key.cleartext)

    package main

import (
	"github.com/descope/pulumi-descope/sdk/go/descope"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		companyKey, err := descope.NewManagementKey(ctx, "company_key", &descope.ManagementKeyArgs{
			Name:        pulumi.String("CI/CD Pipeline Key"),
			Description: pulumi.String("Used by the deployment pipeline to manage users"),
			Rebac: &descope.ManagementKeyRebacArgs{
				CompanyRoles: pulumi.StringArray{
					pulumi.String("<role-name>"),
				},
			},
		})
		if err != nil {
			return err
		}
		ctx.Export("managementKeyValue", companyKey.Cleartext)
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Descope = Descope.Pulumi.Descope;

return await Deployment.RunAsync(() => 
{
    var companyKey = new Descope.ManagementKey("company_key", new()
    {
        Name = "CI/CD Pipeline Key",
        Description = "Used by the deployment pipeline to manage users",
        Rebac = new Descope.Inputs.ManagementKeyRebacArgs
        {
            CompanyRoles = new[]
            {
                "<role-name>",
            },
        },
    });

    return new Dictionary<string, object?>
    {
        ["managementKeyValue"] = companyKey.Cleartext,
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.descope.pulumi.descope.ManagementKey;
import com.descope.pulumi.descope.ManagementKeyArgs;
import com.pulumi.descope.inputs.ManagementKeyRebacArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var companyKey = new ManagementKey("companyKey", ManagementKeyArgs.builder()
            .name("CI/CD Pipeline Key")
            .description("Used by the deployment pipeline to manage users")
            .rebac(ManagementKeyRebacArgs.builder()
                .companyRoles("<role-name>")
                .build())
            .build());

        ctx.export("managementKeyValue", companyKey.cleartext());
    }
}

    resources:
  companyKey:
    type: descope:ManagementKey
    name: company_key
    properties:
      name: CI/CD Pipeline Key
      description: Used by the deployment pipeline to manage users
      rebac:
        companyRoles:
          - <role-name>
outputs:
  # Store the cleartext key in your secrets manager
  managementKeyValue: ${companyKey.cleartext}

    Example coming soon!

    Project-Scoped Key with Expiration

    import * as pulumi from "@pulumi/pulumi";
import * as descope from "@descope/pulumi-descope";

const projectKey = new descope.ManagementKey("project_key", {
    name: "Staging Key",
    description: "Limited access to staging project only",
    expireTime: 1893456000,
    rebac: {
        projectRoles: [{
            projectIds: ["<project-id>"],
            roles: ["<role-name>"],
        }],
    },
});

    import pulumi
import descope_pulumi as descope

project_key = descope.ManagementKey("project_key",
    name="Staging Key",
    description="Limited access to staging project only",
    expire_time=1893456000,
    rebac={
        "project_roles": [{
            "project_ids": ["<project-id>"],
            "roles": ["<role-name>"],
        }],
    })

    package main

import (
	"github.com/descope/pulumi-descope/sdk/go/descope"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := descope.NewManagementKey(ctx, "project_key", &descope.ManagementKeyArgs{
			Name:        pulumi.String("Staging Key"),
			Description: pulumi.String("Limited access to staging project only"),
			ExpireTime:  pulumi.Int(1893456000),
			Rebac: &descope.ManagementKeyRebacArgs{
				ProjectRoles: descope.ManagementKeyRebacProjectRoleArray{
					&descope.ManagementKeyRebacProjectRoleArgs{
						ProjectIds: pulumi.StringArray{
							pulumi.String("<project-id>"),
						},
						Roles: pulumi.StringArray{
							pulumi.String("<role-name>"),
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Descope = Descope.Pulumi.Descope;

return await Deployment.RunAsync(() => 
{
    var projectKey = new Descope.ManagementKey("project_key", new()
    {
        Name = "Staging Key",
        Description = "Limited access to staging project only",
        ExpireTime = 1893456000,
        Rebac = new Descope.Inputs.ManagementKeyRebacArgs
        {
            ProjectRoles = new[]
            {
                new Descope.Inputs.ManagementKeyRebacProjectRoleArgs
                {
                    ProjectIds = new[]
                    {
                        "<project-id>",
                    },
                    Roles = new[]
                    {
                        "<role-name>",
                    },
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.descope.pulumi.descope.ManagementKey;
import com.descope.pulumi.descope.ManagementKeyArgs;
import com.pulumi.descope.inputs.ManagementKeyRebacArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var projectKey = new ManagementKey("projectKey", ManagementKeyArgs.builder()
            .name("Staging Key")
            .description("Limited access to staging project only")
            .expireTime(1893456000)
            .rebac(ManagementKeyRebacArgs.builder()
                .projectRoles(ManagementKeyRebacProjectRoleArgs.builder()
                    .projectIds("<project-id>")
                    .roles("<role-name>")
                    .build())
                .build())
            .build());

    }
}

    resources:
  projectKey:
    type: descope:ManagementKey
    name: project_key
    properties:
      name: Staging Key
      description: Limited access to staging project only
      expireTime: 1.893456e+09
      rebac:
        projectRoles:
          - projectIds:
              - <project-id>
            roles:
              - <role-name>

    Example coming soon!

    Tag-Scoped Key with IP Restriction

    import * as pulumi from "@pulumi/pulumi";
import * as descope from "@descope/pulumi-descope";

const restrictedKey = new descope.ManagementKey("restricted_key", {
    name: "Office Network Key",
    permittedIps: [
        "203.0.113.0/24",
        "198.51.100.10",
    ],
    rebac: {
        tagRoles: [{
            tags: ["production"],
            roles: ["<role-name>"],
        }],
    },
});

    import pulumi
import descope_pulumi as descope

restricted_key = descope.ManagementKey("restricted_key",
    name="Office Network Key",
    permitted_ips=[
        "203.0.113.0/24",
        "198.51.100.10",
    ],
    rebac={
        "tag_roles": [{
            "tags": ["production"],
            "roles": ["<role-name>"],
        }],
    })

    package main

import (
	"github.com/descope/pulumi-descope/sdk/go/descope"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := descope.NewManagementKey(ctx, "restricted_key", &descope.ManagementKeyArgs{
			Name: pulumi.String("Office Network Key"),
			PermittedIps: pulumi.StringArray{
				pulumi.String("203.0.113.0/24"),
				pulumi.String("198.51.100.10"),
			},
			Rebac: &descope.ManagementKeyRebacArgs{
				TagRoles: descope.ManagementKeyRebacTagRoleArray{
					&descope.ManagementKeyRebacTagRoleArgs{
						Tags: pulumi.StringArray{
							pulumi.String("production"),
						},
						Roles: pulumi.StringArray{
							pulumi.String("<role-name>"),
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Descope = Descope.Pulumi.Descope;

return await Deployment.RunAsync(() => 
{
    var restrictedKey = new Descope.ManagementKey("restricted_key", new()
    {
        Name = "Office Network Key",
        PermittedIps = new[]
        {
            "203.0.113.0/24",
            "198.51.100.10",
        },
        Rebac = new Descope.Inputs.ManagementKeyRebacArgs
        {
            TagRoles = new[]
            {
                new Descope.Inputs.ManagementKeyRebacTagRoleArgs
                {
                    Tags = new[]
                    {
                        "production",
                    },
                    Roles = new[]
                    {
                        "<role-name>",
                    },
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.descope.pulumi.descope.ManagementKey;
import com.descope.pulumi.descope.ManagementKeyArgs;
import com.pulumi.descope.inputs.ManagementKeyRebacArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var restrictedKey = new ManagementKey("restrictedKey", ManagementKeyArgs.builder()
            .name("Office Network Key")
            .permittedIps(            
                "203.0.113.0/24",
                "198.51.100.10")
            .rebac(ManagementKeyRebacArgs.builder()
                .tagRoles(ManagementKeyRebacTagRoleArgs.builder()
                    .tags("production")
                    .roles("<role-name>")
                    .build())
                .build())
            .build());

    }
}

    resources:
  restrictedKey:
    type: descope:ManagementKey
    name: restricted_key
    properties:
      name: Office Network Key
      permittedIps:
        - 203.0.113.0/24
        - 198.51.100.10
      rebac:
        tagRoles:
          - tags:
              - production
            roles:
              - <role-name>

    Example coming soon!

    Create ManagementKey Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ManagementKey(name: string, args: ManagementKeyArgs, opts?: CustomResourceOptions);
    @overload
def ManagementKey(resource_name: str,
                  args: ManagementKeyArgs,
                  opts: Optional[ResourceOptions] = None)

@overload
def ManagementKey(resource_name: str,
                  opts: Optional[ResourceOptions] = None,
                  rebac: Optional[ManagementKeyRebacArgs] = None,
                  description: Optional[str] = None,
                  expire_time: Optional[int] = None,
                  name: Optional[str] = None,
                  permitted_ips: Optional[Sequence[str]] = None,
                  status: Optional[str] = None)
    func NewManagementKey(ctx *Context, name string, args ManagementKeyArgs, opts ...ResourceOption) (*ManagementKey, error)
    public ManagementKey(string name, ManagementKeyArgs args, CustomResourceOptions? opts = null)
    public ManagementKey(String name, ManagementKeyArgs args)
public ManagementKey(String name, ManagementKeyArgs args, CustomResourceOptions options)

    type: descope:ManagementKey
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "descope_management_key" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args ManagementKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ManagementKeyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ManagementKeyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ManagementKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ManagementKeyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var managementKeyResource = new Descope.ManagementKey("managementKeyResource", new()
{
    Rebac = new Descope.Inputs.ManagementKeyRebacArgs
    {
        CompanyRoles = new[]
        {
            "string",
        },
        ProjectRoles = new[]
        {
            new Descope.Inputs.ManagementKeyRebacProjectRoleArgs
            {
                ProjectIds = new[]
                {
                    "string",
                },
                Roles = new[]
                {
                    "string",
                },
            },
        },
        TagRoles = new[]
        {
            new Descope.Inputs.ManagementKeyRebacTagRoleArgs
            {
                Roles = new[]
                {
                    "string",
                },
                Tags = new[]
                {
                    "string",
                },
            },
        },
    },
    Description = "string",
    ExpireTime = 0,
    Name = "string",
    PermittedIps = new[]
    {
        "string",
    },
    Status = "string",
});

    example, err := descope.NewManagementKey(ctx, "managementKeyResource", &descope.ManagementKeyArgs{
	Rebac: &descope.ManagementKeyRebacArgs{
		CompanyRoles: pulumi.StringArray{
			pulumi.String("string"),
		},
		ProjectRoles: descope.ManagementKeyRebacProjectRoleArray{
			&descope.ManagementKeyRebacProjectRoleArgs{
				ProjectIds: pulumi.StringArray{
					pulumi.String("string"),
				},
				Roles: pulumi.StringArray{
					pulumi.String("string"),
				},
			},
		},
		TagRoles: descope.ManagementKeyRebacTagRoleArray{
			&descope.ManagementKeyRebacTagRoleArgs{
				Roles: pulumi.StringArray{
					pulumi.String("string"),
				},
				Tags: pulumi.StringArray{
					pulumi.String("string"),
				},
			},
		},
	},
	Description: pulumi.String("string"),
	ExpireTime:  pulumi.Int(0),
	Name:        pulumi.String("string"),
	PermittedIps: pulumi.StringArray{
		pulumi.String("string"),
	},
	Status: pulumi.String("string"),
})

    resource "descope_management_key" "managementKeyResource" {
  lifecycle {
    create_before_destroy = true
  }
  rebac = {
    company_roles = ["string"]
    project_roles = [{
      project_ids = ["string"]
      roles       = ["string"]
    }]
    tag_roles = [{
      roles = ["string"]
      tags  = ["string"]
    }]
  }
  description   = "string"
  expire_time   = 0
  name          = "string"
  permitted_ips = ["string"]
  status        = "string"
}

    var managementKeyResource = new ManagementKey("managementKeyResource", ManagementKeyArgs.builder()
    .rebac(ManagementKeyRebacArgs.builder()
        .companyRoles("string")
        .projectRoles(ManagementKeyRebacProjectRoleArgs.builder()
            .projectIds("string")
            .roles("string")
            .build())
        .tagRoles(ManagementKeyRebacTagRoleArgs.builder()
            .roles("string")
            .tags("string")
            .build())
        .build())
    .description("string")
    .expireTime(0)
    .name("string")
    .permittedIps("string")
    .status("string")
    .build());

    management_key_resource = descope.ManagementKey("managementKeyResource",
    rebac={
        "company_roles": ["string"],
        "project_roles": [{
            "project_ids": ["string"],
            "roles": ["string"],
        }],
        "tag_roles": [{
            "roles": ["string"],
            "tags": ["string"],
        }],
    },
    description="string",
    expire_time=0,
    name="string",
    permitted_ips=["string"],
    status="string")

    const managementKeyResource = new descope.ManagementKey("managementKeyResource", {
    rebac: {
        companyRoles: ["string"],
        projectRoles: [{
            projectIds: ["string"],
            roles: ["string"],
        }],
        tagRoles: [{
            roles: ["string"],
            tags: ["string"],
        }],
    },
    description: "string",
    expireTime: 0,
    name: "string",
    permittedIps: ["string"],
    status: "string",
});

    type: descope:ManagementKey
properties:
    description: string
    expireTime: 0
    name: string
    permittedIps:
        - string
    rebac:
        companyRoles:
            - string
        projectRoles:
            - projectIds:
                - string
              roles:
                - string
        tagRoles:
            - roles:
                - string
              tags:
                - string
    status: string

    ManagementKey Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ManagementKey resource accepts the following input properties:

    Rebac Descope.ManagementKeyRebac
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    Description string
    A description for the management key.
    ExpireTime int
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    Name string
    A name for the management key.
    PermittedIps List<string>
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    Status string
    The status of the management key. Must be either active or inactive.
    Rebac ManagementKeyRebacArgs
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    Description string
    A description for the management key.
    ExpireTime int
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    Name string
    A name for the management key.
    PermittedIps []string
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    Status string
    The status of the management key. Must be either active or inactive.
    rebac object
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    description string
    A description for the management key.
    expire_time number
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    name string
    A name for the management key.
    permitted_ips list(string)
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    status string
    The status of the management key. Must be either active or inactive.
    rebac ManagementKeyRebac
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    description String
    A description for the management key.
    expireTime Integer
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    name String
    A name for the management key.
    permittedIps List<String>
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    status String
    The status of the management key. Must be either active or inactive.
    rebac ManagementKeyRebac
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    description string
    A description for the management key.
    expireTime number
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    name string
    A name for the management key.
    permittedIps string[]
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    status string
    The status of the management key. Must be either active or inactive.
    rebac ManagementKeyRebacArgs
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    description str
    A description for the management key.
    expire_time int
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    name str
    A name for the management key.
    permitted_ips Sequence[str]
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    status str
    The status of the management key. Must be either active or inactive.
    rebac Property Map
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    description String
    A description for the management key.
    expireTime Number
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    name String
    A name for the management key.
    permittedIps List<String>
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    status String
    The status of the management key. Must be either active or inactive.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ManagementKey resource produces the following output properties:

    Cleartext string
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    Id string
    The provider-assigned unique ID for this managed resource.
    Cleartext string
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    Id string
    The provider-assigned unique ID for this managed resource.
    cleartext string
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    id string
    The provider-assigned unique ID for this managed resource.
    cleartext String
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    id String
    The provider-assigned unique ID for this managed resource.
    cleartext string
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    id string
    The provider-assigned unique ID for this managed resource.
    cleartext str
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    id str
    The provider-assigned unique ID for this managed resource.
    cleartext String
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing ManagementKey Resource

    Get an existing ManagementKey resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ManagementKeyState, opts?: CustomResourceOptions): ManagementKey
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        cleartext: Optional[str] = None,
        description: Optional[str] = None,
        expire_time: Optional[int] = None,
        name: Optional[str] = None,
        permitted_ips: Optional[Sequence[str]] = None,
        rebac: Optional[ManagementKeyRebacArgs] = None,
        status: Optional[str] = None) -> ManagementKey
    func GetManagementKey(ctx *Context, name string, id IDInput, state *ManagementKeyState, opts ...ResourceOption) (*ManagementKey, error)
    public static ManagementKey Get(string name, Input<string> id, ManagementKeyState? state, CustomResourceOptions? opts = null)
    public static ManagementKey get(String name, Output<String> id, ManagementKeyState state, CustomResourceOptions options)
    resources:  _:    type: descope:ManagementKey    get:      id: ${id}
    import {
  to = descope_management_key.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Cleartext string
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    Description string
    A description for the management key.
    ExpireTime int
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    Name string
    A name for the management key.
    PermittedIps List<string>
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    Rebac Descope.ManagementKeyRebac
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    Status string
    The status of the management key. Must be either active or inactive.
    Cleartext string
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    Description string
    A description for the management key.
    ExpireTime int
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    Name string
    A name for the management key.
    PermittedIps []string
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    Rebac ManagementKeyRebacArgs
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    Status string
    The status of the management key. Must be either active or inactive.
    cleartext string
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    description string
    A description for the management key.
    expire_time number
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    name string
    A name for the management key.
    permitted_ips list(string)
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    rebac object
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    status string
    The status of the management key. Must be either active or inactive.
    cleartext String
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    description String
    A description for the management key.
    expireTime Integer
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    name String
    A name for the management key.
    permittedIps List<String>
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    rebac ManagementKeyRebac
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    status String
    The status of the management key. Must be either active or inactive.
    cleartext string
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    description string
    A description for the management key.
    expireTime number
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    name string
    A name for the management key.
    permittedIps string[]
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    rebac ManagementKeyRebac
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    status string
    The status of the management key. Must be either active or inactive.
    cleartext str
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    description str
    A description for the management key.
    expire_time int
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    name str
    A name for the management key.
    permitted_ips Sequence[str]
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    rebac ManagementKeyRebacArgs
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    status str
    The status of the management key. Must be either active or inactive.
    cleartext String
    The plaintext value of the management key. This is only available after the key is created and cannot be retrieved later. Store this value securely as it is required to authenticate API requests.
    description String
    A description for the management key.
    expireTime Number
    The expiration time of the management key as a Unix timestamp. If not set, the key will not expire. Changing this value after creation will require the management key to be replaced.
    name String
    A name for the management key.
    permittedIps List<String>
    A list of IP addresses or CIDR ranges that are allowed to use this management key. If not set, the key can be used from any IP address.
    rebac Property Map
    Access control settings for the management key. This defines the permissions granted to the management key, either at the company level or for specific projects or for project tags. Changing this value after creation will require the management key to be replaced.
    status String
    The status of the management key. Must be either active or inactive.

    Supporting Types

    ManagementKeyRebac, ManagementKeyRebacArgs

    CompanyRoles List<string>
    A list of company-level role names that are granted to the management key. This attribute is mutually exclusive with tag_roles and project_roles.
    ProjectRoles List<Descope.ManagementKeyRebacProjectRole>
    A list of project-level role names that are granted to the management key for specific projects by their project ID.
    TagRoles List<Descope.ManagementKeyRebacTagRole>
    A list of project-level role names that are granted to the management key for all projects that have a specific tag.
    CompanyRoles []string
    A list of company-level role names that are granted to the management key. This attribute is mutually exclusive with tag_roles and project_roles.
    ProjectRoles []ManagementKeyRebacProjectRole
    A list of project-level role names that are granted to the management key for specific projects by their project ID.
    TagRoles []ManagementKeyRebacTagRole
    A list of project-level role names that are granted to the management key for all projects that have a specific tag.
    company_roles list(string)
    A list of company-level role names that are granted to the management key. This attribute is mutually exclusive with tag_roles and project_roles.
    project_roles list(object)
    A list of project-level role names that are granted to the management key for specific projects by their project ID.
    tag_roles list(object)
    A list of project-level role names that are granted to the management key for all projects that have a specific tag.
    companyRoles List<String>
    A list of company-level role names that are granted to the management key. This attribute is mutually exclusive with tag_roles and project_roles.
    projectRoles List<ManagementKeyRebacProjectRole>
    A list of project-level role names that are granted to the management key for specific projects by their project ID.
    tagRoles List<ManagementKeyRebacTagRole>
    A list of project-level role names that are granted to the management key for all projects that have a specific tag.
    companyRoles string[]
    A list of company-level role names that are granted to the management key. This attribute is mutually exclusive with tag_roles and project_roles.
    projectRoles ManagementKeyRebacProjectRole[]
    A list of project-level role names that are granted to the management key for specific projects by their project ID.
    tagRoles ManagementKeyRebacTagRole[]
    A list of project-level role names that are granted to the management key for all projects that have a specific tag.
    company_roles Sequence[str]
    A list of company-level role names that are granted to the management key. This attribute is mutually exclusive with tag_roles and project_roles.
    project_roles Sequence[ManagementKeyRebacProjectRole]
    A list of project-level role names that are granted to the management key for specific projects by their project ID.
    tag_roles Sequence[ManagementKeyRebacTagRole]
    A list of project-level role names that are granted to the management key for all projects that have a specific tag.
    companyRoles List<String>
    A list of company-level role names that are granted to the management key. This attribute is mutually exclusive with tag_roles and project_roles.
    projectRoles List<Property Map>
    A list of project-level role names that are granted to the management key for specific projects by their project ID.
    tagRoles List<Property Map>
    A list of project-level role names that are granted to the management key for all projects that have a specific tag.

    ManagementKeyRebacProjectRole, ManagementKeyRebacProjectRoleArgs

    ProjectIds List<string>
    The project IDs this role grant applies to.
    Roles List<string>
    The roles the management key will be granted in the applicable projects.
    ProjectIds []string
    The project IDs this role grant applies to.
    Roles []string
    The roles the management key will be granted in the applicable projects.
    project_ids list(string)
    The project IDs this role grant applies to.
    roles list(string)
    The roles the management key will be granted in the applicable projects.
    projectIds List<String>
    The project IDs this role grant applies to.
    roles List<String>
    The roles the management key will be granted in the applicable projects.
    projectIds string[]
    The project IDs this role grant applies to.
    roles string[]
    The roles the management key will be granted in the applicable projects.
    project_ids Sequence[str]
    The project IDs this role grant applies to.
    roles Sequence[str]
    The roles the management key will be granted in the applicable projects.
    projectIds List<String>
    The project IDs this role grant applies to.
    roles List<String>
    The roles the management key will be granted in the applicable projects.

    ManagementKeyRebacTagRole, ManagementKeyRebacTagRoleArgs

    Roles List<string>
    The roles the management key will be granted in the applicable projects.
    Tags List<string>
    The project tags this role grant applies to.
    Roles []string
    The roles the management key will be granted in the applicable projects.
    Tags []string
    The project tags this role grant applies to.
    roles list(string)
    The roles the management key will be granted in the applicable projects.
    tags list(string)
    The project tags this role grant applies to.
    roles List<String>
    The roles the management key will be granted in the applicable projects.
    tags List<String>
    The project tags this role grant applies to.
    roles string[]
    The roles the management key will be granted in the applicable projects.
    tags string[]
    The project tags this role grant applies to.
    roles Sequence[str]
    The roles the management key will be granted in the applicable projects.
    tags Sequence[str]
    The project tags this role grant applies to.
    roles List<String>
    The roles the management key will be granted in the applicable projects.
    tags List<String>
    The project tags this role grant applies to.

    Package Details

    Repository
    descope descope/pulumi-descope
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the descope Terraform Provider.
    descope logo
    Viewing docs for Descope v0.3.13
    published on Tuesday, Jul 14, 2026 by Descope
    Schema (JSON)
    descope/pulumi-descope

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial