Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Formal Provider
  4. API Docs
  5. IntegrationOidc
Viewing docs for Formal v1.2.4
published on Saturday, Aug 8, 2026 by Formal
Schema (JSON)
formalco/pulumi-formal

formal.IntegrationOidc

formal logo
Viewing docs for Formal v1.2.4
published on Saturday, Aug 8, 2026 by Formal
Schema (JSON)
formalco/pulumi-formal

    Registers an OIDC trust configuration used to authenticate externally signed JWTs to the Formal control plane as a machine user.

    Create IntegrationOidc Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new IntegrationOidc(name: string, args: IntegrationOidcArgs, opts?: CustomResourceOptions);
    @overload
def IntegrationOidc(resource_name: str,
                    args: IntegrationOidcArgs,
                    opts: Optional[ResourceOptions] = None)

@overload
def IntegrationOidc(resource_name: str,
                    opts: Optional[ResourceOptions] = None,
                    issuer: Optional[str] = None,
                    machine_user_id: Optional[str] = None,
                    claim_condition: Optional[str] = None,
                    end_user_email_expression: Optional[str] = None,
                    jwks_uri: Optional[str] = None,
                    name: Optional[str] = None,
                    status: Optional[str] = None)
    func NewIntegrationOidc(ctx *Context, name string, args IntegrationOidcArgs, opts ...ResourceOption) (*IntegrationOidc, error)
    public IntegrationOidc(string name, IntegrationOidcArgs args, CustomResourceOptions? opts = null)
    public IntegrationOidc(String name, IntegrationOidcArgs args)
public IntegrationOidc(String name, IntegrationOidcArgs args, CustomResourceOptions options)

    type: formal:IntegrationOidc
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "formal_integration_oidc" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args IntegrationOidcArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args IntegrationOidcArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args IntegrationOidcArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args IntegrationOidcArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args IntegrationOidcArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var integrationOidcResource = new Pulumi.IntegrationOidc("integrationOidcResource", new()
{
    Issuer = "string",
    MachineUserId = "string",
    ClaimCondition = "string",
    EndUserEmailExpression = "string",
    JwksUri = "string",
    Name = "string",
    Status = "string",
});

    example, err := formal.NewIntegrationOidc(ctx, "integrationOidcResource", &formal.IntegrationOidcArgs{
	Issuer:                 pulumi.String("string"),
	MachineUserId:          pulumi.String("string"),
	ClaimCondition:         pulumi.String("string"),
	EndUserEmailExpression: pulumi.String("string"),
	JwksUri:                pulumi.String("string"),
	Name:                   pulumi.String("string"),
	Status:                 pulumi.String("string"),
})

    resource "formal_integration_oidc" "integrationOidcResource" {
  lifecycle {
    create_before_destroy = true
  }
  issuer                    = "string"
  machine_user_id           = "string"
  claim_condition           = "string"
  end_user_email_expression = "string"
  jwks_uri                  = "string"
  name                      = "string"
  status                    = "string"
}

    var integrationOidcResource = new IntegrationOidc("integrationOidcResource", IntegrationOidcArgs.builder()
    .issuer("string")
    .machineUserId("string")
    .claimCondition("string")
    .endUserEmailExpression("string")
    .jwksUri("string")
    .name("string")
    .status("string")
    .build());

    integration_oidc_resource = formal.IntegrationOidc("integrationOidcResource",
    issuer="string",
    machine_user_id="string",
    claim_condition="string",
    end_user_email_expression="string",
    jwks_uri="string",
    name="string",
    status="string")

    const integrationOidcResource = new formal.IntegrationOidc("integrationOidcResource", {
    issuer: "string",
    machineUserId: "string",
    claimCondition: "string",
    endUserEmailExpression: "string",
    jwksUri: "string",
    name: "string",
    status: "string",
});

    type: formal:IntegrationOidc
properties:
    claimCondition: string
    endUserEmailExpression: string
    issuer: string
    jwksUri: string
    machineUserId: string
    name: string
    status: string

    IntegrationOidc Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The IntegrationOidc resource accepts the following input properties:

    Issuer string
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    MachineUserId string
    ID of the Formal machine user that authenticated OIDC tokens map to.
    ClaimCondition string
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    EndUserEmailExpression string
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    JwksUri string
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    Name string
    Friendly name for the OIDC integration. Must be unique within the organization.
    Status string
    Integration status. Accepted values are active and draft. Draft disables authentication.
    Issuer string
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    MachineUserId string
    ID of the Formal machine user that authenticated OIDC tokens map to.
    ClaimCondition string
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    EndUserEmailExpression string
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    JwksUri string
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    Name string
    Friendly name for the OIDC integration. Must be unique within the organization.
    Status string
    Integration status. Accepted values are active and draft. Draft disables authentication.
    issuer string
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    machine_user_id string
    ID of the Formal machine user that authenticated OIDC tokens map to.
    claim_condition string
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    end_user_email_expression string
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    jwks_uri string
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    name string
    Friendly name for the OIDC integration. Must be unique within the organization.
    status string
    Integration status. Accepted values are active and draft. Draft disables authentication.
    issuer String
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    machineUserId String
    ID of the Formal machine user that authenticated OIDC tokens map to.
    claimCondition String
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    endUserEmailExpression String
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    jwksUri String
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    name String
    Friendly name for the OIDC integration. Must be unique within the organization.
    status String
    Integration status. Accepted values are active and draft. Draft disables authentication.
    issuer string
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    machineUserId string
    ID of the Formal machine user that authenticated OIDC tokens map to.
    claimCondition string
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    endUserEmailExpression string
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    jwksUri string
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    name string
    Friendly name for the OIDC integration. Must be unique within the organization.
    status string
    Integration status. Accepted values are active and draft. Draft disables authentication.
    issuer str
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    machine_user_id str
    ID of the Formal machine user that authenticated OIDC tokens map to.
    claim_condition str
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    end_user_email_expression str
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    jwks_uri str
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    name str
    Friendly name for the OIDC integration. Must be unique within the organization.
    status str
    Integration status. Accepted values are active and draft. Draft disables authentication.
    issuer String
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    machineUserId String
    ID of the Formal machine user that authenticated OIDC tokens map to.
    claimCondition String
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    endUserEmailExpression String
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    jwksUri String
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    name String
    Friendly name for the OIDC integration. Must be unique within the organization.
    status String
    Integration status. Accepted values are active and draft. Draft disables authentication.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the IntegrationOidc resource produces the following output properties:

    Audience string
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    CreatedAt string
    When the integration was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    UpdatedAt string
    When the integration was last updated.
    Audience string
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    CreatedAt string
    When the integration was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    UpdatedAt string
    When the integration was last updated.
    audience string
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    created_at string
    When the integration was created.
    id string
    The provider-assigned unique ID for this managed resource.
    updated_at string
    When the integration was last updated.
    audience String
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    createdAt String
    When the integration was created.
    id String
    The provider-assigned unique ID for this managed resource.
    updatedAt String
    When the integration was last updated.
    audience string
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    createdAt string
    When the integration was created.
    id string
    The provider-assigned unique ID for this managed resource.
    updatedAt string
    When the integration was last updated.
    audience str
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    created_at str
    When the integration was created.
    id str
    The provider-assigned unique ID for this managed resource.
    updated_at str
    When the integration was last updated.
    audience String
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    createdAt String
    When the integration was created.
    id String
    The provider-assigned unique ID for this managed resource.
    updatedAt String
    When the integration was last updated.

    Look up Existing IntegrationOidc Resource

    Get an existing IntegrationOidc resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: IntegrationOidcState, opts?: CustomResourceOptions): IntegrationOidc
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        audience: Optional[str] = None,
        claim_condition: Optional[str] = None,
        created_at: Optional[str] = None,
        end_user_email_expression: Optional[str] = None,
        issuer: Optional[str] = None,
        jwks_uri: Optional[str] = None,
        machine_user_id: Optional[str] = None,
        name: Optional[str] = None,
        status: Optional[str] = None,
        updated_at: Optional[str] = None) -> IntegrationOidc
    func GetIntegrationOidc(ctx *Context, name string, id IDInput, state *IntegrationOidcState, opts ...ResourceOption) (*IntegrationOidc, error)
    public static IntegrationOidc Get(string name, Input<string> id, IntegrationOidcState? state, CustomResourceOptions? opts = null)
    public static IntegrationOidc get(String name, Output<String> id, IntegrationOidcState state, CustomResourceOptions options)
    resources:  _:    type: formal:IntegrationOidc    get:      id: ${id}
    import {
  to = formal_integration_oidc.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Audience string
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    ClaimCondition string
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    CreatedAt string
    When the integration was created.
    EndUserEmailExpression string
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    Issuer string
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    JwksUri string
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    MachineUserId string
    ID of the Formal machine user that authenticated OIDC tokens map to.
    Name string
    Friendly name for the OIDC integration. Must be unique within the organization.
    Status string
    Integration status. Accepted values are active and draft. Draft disables authentication.
    UpdatedAt string
    When the integration was last updated.
    Audience string
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    ClaimCondition string
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    CreatedAt string
    When the integration was created.
    EndUserEmailExpression string
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    Issuer string
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    JwksUri string
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    MachineUserId string
    ID of the Formal machine user that authenticated OIDC tokens map to.
    Name string
    Friendly name for the OIDC integration. Must be unique within the organization.
    Status string
    Integration status. Accepted values are active and draft. Draft disables authentication.
    UpdatedAt string
    When the integration was last updated.
    audience string
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    claim_condition string
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    created_at string
    When the integration was created.
    end_user_email_expression string
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    issuer string
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    jwks_uri string
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    machine_user_id string
    ID of the Formal machine user that authenticated OIDC tokens map to.
    name string
    Friendly name for the OIDC integration. Must be unique within the organization.
    status string
    Integration status. Accepted values are active and draft. Draft disables authentication.
    updated_at string
    When the integration was last updated.
    audience String
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    claimCondition String
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    createdAt String
    When the integration was created.
    endUserEmailExpression String
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    issuer String
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    jwksUri String
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    machineUserId String
    ID of the Formal machine user that authenticated OIDC tokens map to.
    name String
    Friendly name for the OIDC integration. Must be unique within the organization.
    status String
    Integration status. Accepted values are active and draft. Draft disables authentication.
    updatedAt String
    When the integration was last updated.
    audience string
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    claimCondition string
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    createdAt string
    When the integration was created.
    endUserEmailExpression string
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    issuer string
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    jwksUri string
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    machineUserId string
    ID of the Formal machine user that authenticated OIDC tokens map to.
    name string
    Friendly name for the OIDC integration. Must be unique within the organization.
    status string
    Integration status. Accepted values are active and draft. Draft disables authentication.
    updatedAt string
    When the integration was last updated.
    audience str
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    claim_condition str
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    created_at str
    When the integration was created.
    end_user_email_expression str
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    issuer str
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    jwks_uri str
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    machine_user_id str
    ID of the Formal machine user that authenticated OIDC tokens map to.
    name str
    Friendly name for the OIDC integration. Must be unique within the organization.
    status str
    Integration status. Accepted values are active and draft. Draft disables authentication.
    updated_at str
    When the integration was last updated.
    audience String
    The Formal audience value that tokens must present: oidc.formal.ai/{id}.
    claimCondition String
    CEL expression evaluated against verified token claims. Must return a boolean. Defaults to true.
    createdAt String
    When the integration was created.
    endUserEmailExpression String
    Optional CEL expression over verified token claims that must evaluate to a string email. When set, federation mint resolves a Formal human by case-insensitive email. Leave unset for machine-only trusts. Examples: claims.owner_email (Cursor); claims.sub.split('/').last() (AWSReservedSSO session name when the session name is an email).
    issuer String
    OIDC issuer URL. Must be absolute HTTPS (path preserved). In local ENV=dev, the configured fake OIDC provider origin may use HTTP.
    jwksUri String
    Optional JWKS URI. When unset, Formal uses OIDC Discovery from the issuer. Must be absolute HTTPS when set.
    machineUserId String
    ID of the Formal machine user that authenticated OIDC tokens map to.
    name String
    Friendly name for the OIDC integration. Must be unique within the organization.
    status String
    Integration status. Accepted values are active and draft. Draft disables authentication.
    updatedAt String
    When the integration was last updated.

    Package Details

    Repository
    formal formalco/pulumi-formal
    License
    MPL-2.0
    Notes
    This Pulumi package is based on the formal Terraform Provider.
    formal logo
    Viewing docs for Formal v1.2.4
    published on Saturday, Aug 8, 2026 by Formal
    Schema (JSON)
    formalco/pulumi-formal

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial