Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Gitlab Provider
  4. API Docs
  5. ProjectServiceAccountAccessToken
Viewing docs for GitLab v10.2.0
published on Wednesday, Aug 26, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-gitlab

gitlab.ProjectServiceAccountAccessToken

gitlab logo
Viewing docs for GitLab v10.2.0
published on Wednesday, Aug 26, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-gitlab

    The gitlab.ProjectServiceAccountAccessToken resource manages the lifecycle of a project service account access token.

    Use of the timestamp() function with expiresAt will cause the resource to be re-created with every apply, it’s recommended to use plantimestamp() or a static value instead.

    Reading the access token status of a service account requires an admin token. As a result, this resource will ignore permission errors when attempting to read the token status, and will rely on the values in state instead. This can lead to apply-time failures if the token configured for the provider doesn’t have permissions to rotate tokens for the service account.

    Use rotationConfiguration to automatically rotate tokens instead of using timestamp() as timestamp will cause changes with every plan. pulumi up must still be run to rotate the token.

    Upstream API: GitLab API docs

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as gitlab from "@pulumi/gitlab";

const example = new gitlab.Project("example", {
    name: "example",
    description: "An example project",
});
// The service account against the project
const exampleSa = new gitlab.ProjectServiceAccount("example_sa", {
    project: example.id,
    name: "example-name",
    username: "example-username",
});
// To assign the service account to a project as a member
const exampleMembership = new gitlab.ProjectMembership("example_membership", {
    project: example.id,
    userId: exampleSa.serviceAccountId.apply(x =>Number(x)),
    accessLevel: "developer",
    expiresAt: "2020-03-14",
});
// The service account access token with no expiry
const exampleSaTokenNoExpiry = new gitlab.ProjectServiceAccountAccessToken("example_sa_token_no_expiry", {
    project: example.id,
    userId: exampleSa.serviceAccountId.apply(x =>Number(x)),
    name: "Example service account access token",
    scopes: ["api"],
});
// The service account access token with expires at
const exampleSaTokenExpiresAt = new gitlab.ProjectServiceAccountAccessToken("example_sa_token_expires_at", {
    project: example.id,
    userId: exampleSa.serviceAccountId.apply(x =>Number(x)),
    name: "Example service account access token",
    expiresAt: "2020-03-14",
    scopes: ["api"],
});
// The service account access token with rotation configuration
const exampleSaTokenRotationConfiguration = new gitlab.ProjectServiceAccountAccessToken("example_sa_token_rotation_configuration", {
    project: example.id,
    userId: exampleSa.serviceAccountId.apply(x =>Number(x)),
    name: "Example service account access token",
    rotationConfiguration: {
        rotateBeforeDays: 2,
        expirationDays: 7,
    },
    scopes: ["api"],
});

    import pulumi
import pulumi_gitlab as gitlab

example = gitlab.Project("example",
    name="example",
    description="An example project")
# The service account against the project
example_sa = gitlab.ProjectServiceAccount("example_sa",
    project=example.id,
    name="example-name",
    username="example-username")
# To assign the service account to a project as a member
example_membership = gitlab.ProjectMembership("example_membership",
    project=example.id,
    user_id=example_sa.service_account_id.apply(lambda x: int(x)),
    access_level="developer",
    expires_at="2020-03-14")
# The service account access token with no expiry
example_sa_token_no_expiry = gitlab.ProjectServiceAccountAccessToken("example_sa_token_no_expiry",
    project=example.id,
    user_id=example_sa.service_account_id.apply(lambda x: int(x)),
    name="Example service account access token",
    scopes=["api"])
# The service account access token with expires at
example_sa_token_expires_at = gitlab.ProjectServiceAccountAccessToken("example_sa_token_expires_at",
    project=example.id,
    user_id=example_sa.service_account_id.apply(lambda x: int(x)),
    name="Example service account access token",
    expires_at="2020-03-14",
    scopes=["api"])
# The service account access token with rotation configuration
example_sa_token_rotation_configuration = gitlab.ProjectServiceAccountAccessToken("example_sa_token_rotation_configuration",
    project=example.id,
    user_id=example_sa.service_account_id.apply(lambda x: int(x)),
    name="Example service account access token",
    rotation_configuration={
        "rotate_before_days": 2,
        "expiration_days": 7,
    },
    scopes=["api"])

    package main

import (
	"github.com/pulumi/pulumi-gitlab/sdk/v10/go/gitlab"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := gitlab.NewProject(ctx, "example", &gitlab.ProjectArgs{
			Name:        pulumi.String("example"),
			Description: pulumi.String("An example project"),
		})
		if err != nil {
			return err
		}
		// The service account against the project
		exampleSa, err := gitlab.NewProjectServiceAccount(ctx, "example_sa", &gitlab.ProjectServiceAccountArgs{
			Project:  example.ID().ToIDOutput().ToStringOutput(),
			Name:     pulumi.String("example-name"),
			Username: pulumi.String("example-username"),
		})
		if err != nil {
			return err
		}
		// To assign the service account to a project as a member
		_, err = gitlab.NewProjectMembership(ctx, "example_membership", &gitlab.ProjectMembershipArgs{
			Project:     example.ID().ToIDOutput().ToStringOutput(),
			UserId:      exampleSa.ServiceAccountId,
			AccessLevel: pulumi.String("developer"),
			ExpiresAt:   pulumi.String("2020-03-14"),
		})
		if err != nil {
			return err
		}
		// The service account access token with no expiry
		_, err = gitlab.NewProjectServiceAccountAccessToken(ctx, "example_sa_token_no_expiry", &gitlab.ProjectServiceAccountAccessTokenArgs{
			Project: example.ID().ToIDOutput().ToStringOutput(),
			UserId:  exampleSa.ServiceAccountId,
			Name:    pulumi.String("Example service account access token"),
			Scopes: pulumi.StringArray{
				pulumi.String("api"),
			},
		})
		if err != nil {
			return err
		}
		// The service account access token with expires at
		_, err = gitlab.NewProjectServiceAccountAccessToken(ctx, "example_sa_token_expires_at", &gitlab.ProjectServiceAccountAccessTokenArgs{
			Project:   example.ID().ToIDOutput().ToStringOutput(),
			UserId:    exampleSa.ServiceAccountId,
			Name:      pulumi.String("Example service account access token"),
			ExpiresAt: pulumi.String("2020-03-14"),
			Scopes: pulumi.StringArray{
				pulumi.String("api"),
			},
		})
		if err != nil {
			return err
		}
		// The service account access token with rotation configuration
		_, err = gitlab.NewProjectServiceAccountAccessToken(ctx, "example_sa_token_rotation_configuration", &gitlab.ProjectServiceAccountAccessTokenArgs{
			Project: example.ID().ToIDOutput().ToStringOutput(),
			UserId:  exampleSa.ServiceAccountId,
			Name:    pulumi.String("Example service account access token"),
			RotationConfiguration: &gitlab.ProjectServiceAccountAccessTokenRotationConfigurationArgs{
				RotateBeforeDays: pulumi.Int(2),
				ExpirationDays:   pulumi.Int(7),
			},
			Scopes: pulumi.StringArray{
				pulumi.String("api"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using GitLab = Pulumi.GitLab;

return await Deployment.RunAsync(() => 
{
    var example = new GitLab.Project("example", new()
    {
        Name = "example",
        Description = "An example project",
    });

    // The service account against the project
    var exampleSa = new GitLab.ProjectServiceAccount("example_sa", new()
    {
        Project = example.Id,
        Name = "example-name",
        Username = "example-username",
    });

    // To assign the service account to a project as a member
    var exampleMembership = new GitLab.ProjectMembership("example_membership", new()
    {
        Project = example.Id,
        UserId = exampleSa.ServiceAccountId,
        AccessLevel = "developer",
        ExpiresAt = "2020-03-14",
    });

    // The service account access token with no expiry
    var exampleSaTokenNoExpiry = new GitLab.ProjectServiceAccountAccessToken("example_sa_token_no_expiry", new()
    {
        Project = example.Id,
        UserId = exampleSa.ServiceAccountId,
        Name = "Example service account access token",
        Scopes = new[]
        {
            "api",
        },
    });

    // The service account access token with expires at
    var exampleSaTokenExpiresAt = new GitLab.ProjectServiceAccountAccessToken("example_sa_token_expires_at", new()
    {
        Project = example.Id,
        UserId = exampleSa.ServiceAccountId,
        Name = "Example service account access token",
        ExpiresAt = "2020-03-14",
        Scopes = new[]
        {
            "api",
        },
    });

    // The service account access token with rotation configuration
    var exampleSaTokenRotationConfiguration = new GitLab.ProjectServiceAccountAccessToken("example_sa_token_rotation_configuration", new()
    {
        Project = example.Id,
        UserId = exampleSa.ServiceAccountId,
        Name = "Example service account access token",
        RotationConfiguration = new GitLab.Inputs.ProjectServiceAccountAccessTokenRotationConfigurationArgs
        {
            RotateBeforeDays = 2,
            ExpirationDays = 7,
        },
        Scopes = new[]
        {
            "api",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gitlab.Project;
import com.pulumi.gitlab.ProjectArgs;
import com.pulumi.gitlab.ProjectServiceAccount;
import com.pulumi.gitlab.ProjectServiceAccountArgs;
import com.pulumi.gitlab.ProjectMembership;
import com.pulumi.gitlab.ProjectMembershipArgs;
import com.pulumi.gitlab.ProjectServiceAccountAccessToken;
import com.pulumi.gitlab.ProjectServiceAccountAccessTokenArgs;
import com.pulumi.gitlab.inputs.ProjectServiceAccountAccessTokenRotationConfigurationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Project("example", ProjectArgs.builder()
            .name("example")
            .description("An example project")
            .build());

        // The service account against the project
        var exampleSa = new ProjectServiceAccount("exampleSa", ProjectServiceAccountArgs.builder()
            .project(example.id())
            .name("example-name")
            .username("example-username")
            .build());

        // To assign the service account to a project as a member
        var exampleMembership = new ProjectMembership("exampleMembership", ProjectMembershipArgs.builder()
            .project(example.id())
            .userId(exampleSa.serviceAccountId())
            .accessLevel("developer")
            .expiresAt("2020-03-14")
            .build());

        // The service account access token with no expiry
        var exampleSaTokenNoExpiry = new ProjectServiceAccountAccessToken("exampleSaTokenNoExpiry", ProjectServiceAccountAccessTokenArgs.builder()
            .project(example.id())
            .userId(exampleSa.serviceAccountId())
            .name("Example service account access token")
            .scopes("api")
            .build());

        // The service account access token with expires at
        var exampleSaTokenExpiresAt = new ProjectServiceAccountAccessToken("exampleSaTokenExpiresAt", ProjectServiceAccountAccessTokenArgs.builder()
            .project(example.id())
            .userId(exampleSa.serviceAccountId())
            .name("Example service account access token")
            .expiresAt("2020-03-14")
            .scopes("api")
            .build());

        // The service account access token with rotation configuration
        var exampleSaTokenRotationConfiguration = new ProjectServiceAccountAccessToken("exampleSaTokenRotationConfiguration", ProjectServiceAccountAccessTokenArgs.builder()
            .project(example.id())
            .userId(exampleSa.serviceAccountId())
            .name("Example service account access token")
            .rotationConfiguration(ProjectServiceAccountAccessTokenRotationConfigurationArgs.builder()
                .rotateBeforeDays(2)
                .expirationDays(7)
                .build())
            .scopes("api")
            .build());

    }
}

    resources:
  example:
    type: gitlab:Project
    properties:
      name: example
      description: An example project
  # The service account against the project
  exampleSa:
    type: gitlab:ProjectServiceAccount
    name: example_sa
    properties:
      project: ${example.id}
      name: example-name
      username: example-username
  # To assign the service account to a project as a member
  exampleMembership:
    type: gitlab:ProjectMembership
    name: example_membership
    properties:
      project: ${example.id}
      userId: ${exampleSa.serviceAccountId}
      accessLevel: developer
      expiresAt: 2020-03-14
  # The service account access token with no expiry
  exampleSaTokenNoExpiry:
    type: gitlab:ProjectServiceAccountAccessToken
    name: example_sa_token_no_expiry
    properties:
      project: ${example.id}
      userId: ${exampleSa.serviceAccountId}
      name: Example service account access token
      scopes:
        - api
  # The service account access token with expires at
  exampleSaTokenExpiresAt:
    type: gitlab:ProjectServiceAccountAccessToken
    name: example_sa_token_expires_at
    properties:
      project: ${example.id}
      userId: ${exampleSa.serviceAccountId}
      name: Example service account access token
      expiresAt: 2020-03-14
      scopes:
        - api
  # The service account access token with rotation configuration
  exampleSaTokenRotationConfiguration:
    type: gitlab:ProjectServiceAccountAccessToken
    name: example_sa_token_rotation_configuration
    properties:
      project: ${example.id}
      userId: ${exampleSa.serviceAccountId}
      name: Example service account access token
      rotationConfiguration:
        rotateBeforeDays: 2
        expirationDays: 7
      scopes:
        - api

    pulumi {
  required_providers {
    gitlab = {
      source = "pulumi/gitlab"
    }
  }
}

resource "gitlab_project" "example" {
  name        = "example"
  description = "An example project"
}
# The service account against the project
resource "gitlab_projectserviceaccount" "example_sa" {
  project  = gitlab_project.example.id
  name     = "example-name"
  username = "example-username"
}
# To assign the service account to a project as a member
resource "gitlab_projectmembership" "example_membership" {
  project      = gitlab_project.example.id
  user_id      = gitlab_projectserviceaccount.example_sa.service_account_id
  access_level = "developer"
  expires_at   = "2020-03-14"
}
# The service account access token with no expiry
resource "gitlab_projectserviceaccountaccesstoken" "example_sa_token_no_expiry" {
  project = gitlab_project.example.id
  user_id = gitlab_projectserviceaccount.example_sa.service_account_id
  name    = "Example service account access token"
  scopes  = ["api"]
}
# The service account access token with expires at
resource "gitlab_projectserviceaccountaccesstoken" "example_sa_token_expires_at" {
  project    = gitlab_project.example.id
  user_id    = gitlab_projectserviceaccount.example_sa.service_account_id
  name       = "Example service account access token"
  expires_at = "2020-03-14"
  scopes     = ["api"]
}
# The service account access token with rotation configuration
resource "gitlab_projectserviceaccountaccesstoken" "example_sa_token_rotation_configuration" {
  project = gitlab_project.example.id
  user_id = gitlab_projectserviceaccount.example_sa.service_account_id
  name    = "Example service account access token"
  rotation_configuration = {
    rotate_before_days = 2
    expiration_days    = 7
  }
  scopes = ["api"]
}

    Create ProjectServiceAccountAccessToken Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ProjectServiceAccountAccessToken(name: string, args: ProjectServiceAccountAccessTokenArgs, opts?: CustomResourceOptions);
    @overload
def ProjectServiceAccountAccessToken(resource_name: str,
                                     args: ProjectServiceAccountAccessTokenArgs,
                                     opts: Optional[ResourceOptions] = None)

@overload
def ProjectServiceAccountAccessToken(resource_name: str,
                                     opts: Optional[ResourceOptions] = None,
                                     project: Optional[str] = None,
                                     scopes: Optional[Sequence[str]] = None,
                                     user_id: Optional[int] = None,
                                     expires_at: Optional[str] = None,
                                     name: Optional[str] = None,
                                     rotation_configuration: Optional[ProjectServiceAccountAccessTokenRotationConfigurationArgs] = None,
                                     validate_past_expiration_date: Optional[bool] = None)
    func NewProjectServiceAccountAccessToken(ctx *Context, name string, args ProjectServiceAccountAccessTokenArgs, opts ...ResourceOption) (*ProjectServiceAccountAccessToken, error)
    public ProjectServiceAccountAccessToken(string name, ProjectServiceAccountAccessTokenArgs args, CustomResourceOptions? opts = null)
    public ProjectServiceAccountAccessToken(String name, ProjectServiceAccountAccessTokenArgs args)
public ProjectServiceAccountAccessToken(String name, ProjectServiceAccountAccessTokenArgs args, CustomResourceOptions options)

    type: gitlab:ProjectServiceAccountAccessToken
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "gitlab_project_service_account_access_token" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args ProjectServiceAccountAccessTokenArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ProjectServiceAccountAccessTokenArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ProjectServiceAccountAccessTokenArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ProjectServiceAccountAccessTokenArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ProjectServiceAccountAccessTokenArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var projectServiceAccountAccessTokenResource = new GitLab.ProjectServiceAccountAccessToken("projectServiceAccountAccessTokenResource", new()
{
    Project = "string",
    Scopes = new[]
    {
        "string",
    },
    UserId = 0,
    ExpiresAt = "string",
    Name = "string",
    RotationConfiguration = new GitLab.Inputs.ProjectServiceAccountAccessTokenRotationConfigurationArgs
    {
        RotateBeforeDays = 0,
        ExpirationDays = 0,
    },
    ValidatePastExpirationDate = false,
});

    example, err := gitlab.NewProjectServiceAccountAccessToken(ctx, "projectServiceAccountAccessTokenResource", &gitlab.ProjectServiceAccountAccessTokenArgs{
	Project: pulumi.String("string"),
	Scopes: pulumi.StringArray{
		pulumi.String("string"),
	},
	UserId:    pulumi.Int(0),
	ExpiresAt: pulumi.String("string"),
	Name:      pulumi.String("string"),
	RotationConfiguration: &gitlab.ProjectServiceAccountAccessTokenRotationConfigurationArgs{
		RotateBeforeDays: pulumi.Int(0),
		ExpirationDays:   pulumi.Int(0),
	},
	ValidatePastExpirationDate: pulumi.Bool(false),
})

    resource "gitlab_project_service_account_access_token" "projectServiceAccountAccessTokenResource" {
  lifecycle {
    create_before_destroy = true
  }
  project    = "string"
  scopes     = ["string"]
  user_id    = 0
  expires_at = "string"
  name       = "string"
  rotation_configuration = {
    rotate_before_days = 0
    expiration_days    = 0
  }
  validate_past_expiration_date = false
}

    var projectServiceAccountAccessTokenResource = new ProjectServiceAccountAccessToken("projectServiceAccountAccessTokenResource", ProjectServiceAccountAccessTokenArgs.builder()
    .project("string")
    .scopes("string")
    .userId(0)
    .expiresAt("string")
    .name("string")
    .rotationConfiguration(ProjectServiceAccountAccessTokenRotationConfigurationArgs.builder()
        .rotateBeforeDays(0)
        .expirationDays(0)
        .build())
    .validatePastExpirationDate(false)
    .build());

    project_service_account_access_token_resource = gitlab.ProjectServiceAccountAccessToken("projectServiceAccountAccessTokenResource",
    project="string",
    scopes=["string"],
    user_id=0,
    expires_at="string",
    name="string",
    rotation_configuration={
        "rotate_before_days": 0,
        "expiration_days": 0,
    },
    validate_past_expiration_date=False)

    const projectServiceAccountAccessTokenResource = new gitlab.ProjectServiceAccountAccessToken("projectServiceAccountAccessTokenResource", {
    project: "string",
    scopes: ["string"],
    userId: 0,
    expiresAt: "string",
    name: "string",
    rotationConfiguration: {
        rotateBeforeDays: 0,
        expirationDays: 0,
    },
    validatePastExpirationDate: false,
});

    type: gitlab:ProjectServiceAccountAccessToken
properties:
    expiresAt: string
    name: string
    project: string
    rotationConfiguration:
        expirationDays: 0
        rotateBeforeDays: 0
    scopes:
        - string
    userId: 0
    validatePastExpirationDate: false

    ProjectServiceAccountAccessToken Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ProjectServiceAccountAccessToken resource accepts the following input properties:

    Project string
    The ID or URL-encoded path of the project containing the service account.
    Scopes List<string>
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    UserId int
    The ID of a service account user.
    ExpiresAt string
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    Name string
    The name of the personal access token.
    RotationConfiguration Pulumi.GitLab.Inputs.ProjectServiceAccountAccessTokenRotationConfiguration
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    ValidatePastExpirationDate bool
    Whether to validate if the expiration date is in the future.
    Project string
    The ID or URL-encoded path of the project containing the service account.
    Scopes []string
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    UserId int
    The ID of a service account user.
    ExpiresAt string
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    Name string
    The name of the personal access token.
    RotationConfiguration ProjectServiceAccountAccessTokenRotationConfigurationArgs
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    ValidatePastExpirationDate bool
    Whether to validate if the expiration date is in the future.
    project string
    The ID or URL-encoded path of the project containing the service account.
    scopes list(string)
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    user_id number
    The ID of a service account user.
    expires_at string
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    name string
    The name of the personal access token.
    rotation_configuration object
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    validate_past_expiration_date bool
    Whether to validate if the expiration date is in the future.
    project String
    The ID or URL-encoded path of the project containing the service account.
    scopes List<String>
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    userId Integer
    The ID of a service account user.
    expiresAt String
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    name String
    The name of the personal access token.
    rotationConfiguration ProjectServiceAccountAccessTokenRotationConfiguration
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    validatePastExpirationDate Boolean
    Whether to validate if the expiration date is in the future.
    project string
    The ID or URL-encoded path of the project containing the service account.
    scopes string[]
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    userId number
    The ID of a service account user.
    expiresAt string
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    name string
    The name of the personal access token.
    rotationConfiguration ProjectServiceAccountAccessTokenRotationConfiguration
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    validatePastExpirationDate boolean
    Whether to validate if the expiration date is in the future.
    project str
    The ID or URL-encoded path of the project containing the service account.
    scopes Sequence[str]
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    user_id int
    The ID of a service account user.
    expires_at str
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    name str
    The name of the personal access token.
    rotation_configuration ProjectServiceAccountAccessTokenRotationConfigurationArgs
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    validate_past_expiration_date bool
    Whether to validate if the expiration date is in the future.
    project String
    The ID or URL-encoded path of the project containing the service account.
    scopes List<String>
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    userId Number
    The ID of a service account user.
    expiresAt String
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    name String
    The name of the personal access token.
    rotationConfiguration Property Map
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    validatePastExpirationDate Boolean
    Whether to validate if the expiration date is in the future.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ProjectServiceAccountAccessToken resource produces the following output properties:

    Active bool
    True if the token is active.
    CreatedAt string
    Time the token has been created, RFC3339 format.
    Id string
    The provider-assigned unique ID for this managed resource.
    Revoked bool
    True if the token is revoked.
    Token string
    The token of the project service account access token. Note: the token is not available for imported resources.
    Active bool
    True if the token is active.
    CreatedAt string
    Time the token has been created, RFC3339 format.
    Id string
    The provider-assigned unique ID for this managed resource.
    Revoked bool
    True if the token is revoked.
    Token string
    The token of the project service account access token. Note: the token is not available for imported resources.
    active bool
    True if the token is active.
    created_at string
    Time the token has been created, RFC3339 format.
    id string
    The provider-assigned unique ID for this managed resource.
    revoked bool
    True if the token is revoked.
    token string
    The token of the project service account access token. Note: the token is not available for imported resources.
    active Boolean
    True if the token is active.
    createdAt String
    Time the token has been created, RFC3339 format.
    id String
    The provider-assigned unique ID for this managed resource.
    revoked Boolean
    True if the token is revoked.
    token String
    The token of the project service account access token. Note: the token is not available for imported resources.
    active boolean
    True if the token is active.
    createdAt string
    Time the token has been created, RFC3339 format.
    id string
    The provider-assigned unique ID for this managed resource.
    revoked boolean
    True if the token is revoked.
    token string
    The token of the project service account access token. Note: the token is not available for imported resources.
    active bool
    True if the token is active.
    created_at str
    Time the token has been created, RFC3339 format.
    id str
    The provider-assigned unique ID for this managed resource.
    revoked bool
    True if the token is revoked.
    token str
    The token of the project service account access token. Note: the token is not available for imported resources.
    active Boolean
    True if the token is active.
    createdAt String
    Time the token has been created, RFC3339 format.
    id String
    The provider-assigned unique ID for this managed resource.
    revoked Boolean
    True if the token is revoked.
    token String
    The token of the project service account access token. Note: the token is not available for imported resources.

    Look up Existing ProjectServiceAccountAccessToken Resource

    Get an existing ProjectServiceAccountAccessToken resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ProjectServiceAccountAccessTokenState, opts?: CustomResourceOptions): ProjectServiceAccountAccessToken
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        active: Optional[bool] = None,
        created_at: Optional[str] = None,
        expires_at: Optional[str] = None,
        name: Optional[str] = None,
        project: Optional[str] = None,
        revoked: Optional[bool] = None,
        rotation_configuration: Optional[ProjectServiceAccountAccessTokenRotationConfigurationArgs] = None,
        scopes: Optional[Sequence[str]] = None,
        token: Optional[str] = None,
        user_id: Optional[int] = None,
        validate_past_expiration_date: Optional[bool] = None) -> ProjectServiceAccountAccessToken
    func GetProjectServiceAccountAccessToken(ctx *Context, name string, id IDInput, state *ProjectServiceAccountAccessTokenState, opts ...ResourceOption) (*ProjectServiceAccountAccessToken, error)
    public static ProjectServiceAccountAccessToken Get(string name, Input<string> id, ProjectServiceAccountAccessTokenState? state, CustomResourceOptions? opts = null)
    public static ProjectServiceAccountAccessToken get(String name, Output<String> id, ProjectServiceAccountAccessTokenState state, CustomResourceOptions options)
    resources:  _:    type: gitlab:ProjectServiceAccountAccessToken    get:      id: ${id}
    import {
  to = gitlab_project_service_account_access_token.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Active bool
    True if the token is active.
    CreatedAt string
    Time the token has been created, RFC3339 format.
    ExpiresAt string
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    Name string
    The name of the personal access token.
    Project string
    The ID or URL-encoded path of the project containing the service account.
    Revoked bool
    True if the token is revoked.
    RotationConfiguration Pulumi.GitLab.Inputs.ProjectServiceAccountAccessTokenRotationConfiguration
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    Scopes List<string>
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    Token string
    The token of the project service account access token. Note: the token is not available for imported resources.
    UserId int
    The ID of a service account user.
    ValidatePastExpirationDate bool
    Whether to validate if the expiration date is in the future.
    Active bool
    True if the token is active.
    CreatedAt string
    Time the token has been created, RFC3339 format.
    ExpiresAt string
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    Name string
    The name of the personal access token.
    Project string
    The ID or URL-encoded path of the project containing the service account.
    Revoked bool
    True if the token is revoked.
    RotationConfiguration ProjectServiceAccountAccessTokenRotationConfigurationArgs
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    Scopes []string
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    Token string
    The token of the project service account access token. Note: the token is not available for imported resources.
    UserId int
    The ID of a service account user.
    ValidatePastExpirationDate bool
    Whether to validate if the expiration date is in the future.
    active bool
    True if the token is active.
    created_at string
    Time the token has been created, RFC3339 format.
    expires_at string
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    name string
    The name of the personal access token.
    project string
    The ID or URL-encoded path of the project containing the service account.
    revoked bool
    True if the token is revoked.
    rotation_configuration object
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    scopes list(string)
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    token string
    The token of the project service account access token. Note: the token is not available for imported resources.
    user_id number
    The ID of a service account user.
    validate_past_expiration_date bool
    Whether to validate if the expiration date is in the future.
    active Boolean
    True if the token is active.
    createdAt String
    Time the token has been created, RFC3339 format.
    expiresAt String
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    name String
    The name of the personal access token.
    project String
    The ID or URL-encoded path of the project containing the service account.
    revoked Boolean
    True if the token is revoked.
    rotationConfiguration ProjectServiceAccountAccessTokenRotationConfiguration
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    scopes List<String>
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    token String
    The token of the project service account access token. Note: the token is not available for imported resources.
    userId Integer
    The ID of a service account user.
    validatePastExpirationDate Boolean
    Whether to validate if the expiration date is in the future.
    active boolean
    True if the token is active.
    createdAt string
    Time the token has been created, RFC3339 format.
    expiresAt string
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    name string
    The name of the personal access token.
    project string
    The ID or URL-encoded path of the project containing the service account.
    revoked boolean
    True if the token is revoked.
    rotationConfiguration ProjectServiceAccountAccessTokenRotationConfiguration
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    scopes string[]
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    token string
    The token of the project service account access token. Note: the token is not available for imported resources.
    userId number
    The ID of a service account user.
    validatePastExpirationDate boolean
    Whether to validate if the expiration date is in the future.
    active bool
    True if the token is active.
    created_at str
    Time the token has been created, RFC3339 format.
    expires_at str
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    name str
    The name of the personal access token.
    project str
    The ID or URL-encoded path of the project containing the service account.
    revoked bool
    True if the token is revoked.
    rotation_configuration ProjectServiceAccountAccessTokenRotationConfigurationArgs
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    scopes Sequence[str]
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    token str
    The token of the project service account access token. Note: the token is not available for imported resources.
    user_id int
    The ID of a service account user.
    validate_past_expiration_date bool
    Whether to validate if the expiration date is in the future.
    active Boolean
    True if the token is active.
    createdAt String
    Time the token has been created, RFC3339 format.
    expiresAt String
    The service account access token expiry date. When left blank, the token follows the standard rule of expiry for personal access tokens.
    name String
    The name of the personal access token.
    project String
    The ID or URL-encoded path of the project containing the service account.
    revoked Boolean
    True if the token is revoked.
    rotationConfiguration Property Map
    The configuration for when to rotate a token automatically. Will not rotate a token until pulumi up is run.
    scopes List<String>
    The scopes of the project service account access token. Valid values are: api, readUser, readApi, readRepository, writeRepository, readRegistry, writeRegistry, readVirtualRegistry, writeVirtualRegistry, sudo, adminMode, createRunner, manageRunner, aiFeatures, k8sProxy, selfRotate, readServicePing. If selfRotate is included, you must also provide either expiresAt or rotationConfiguration.
    token String
    The token of the project service account access token. Note: the token is not available for imported resources.
    userId Number
    The ID of a service account user.
    validatePastExpirationDate Boolean
    Whether to validate if the expiration date is in the future.

    Supporting Types

    ProjectServiceAccountAccessTokenRotationConfiguration, ProjectServiceAccountAccessTokenRotationConfigurationArgs

    RotateBeforeDays int
    The duration (in days) before the expiration when the token should be rotated. As an example, if set to 7 days, the token will rotate 7 days before the expiration date, but only when pulumi up is run in that timeframe.
    ExpirationDays int
    The duration (in days) the new token should be valid for.
    RotateBeforeDays int
    The duration (in days) before the expiration when the token should be rotated. As an example, if set to 7 days, the token will rotate 7 days before the expiration date, but only when pulumi up is run in that timeframe.
    ExpirationDays int
    The duration (in days) the new token should be valid for.
    rotate_before_days number
    The duration (in days) before the expiration when the token should be rotated. As an example, if set to 7 days, the token will rotate 7 days before the expiration date, but only when pulumi up is run in that timeframe.
    expiration_days number
    The duration (in days) the new token should be valid for.
    rotateBeforeDays Integer
    The duration (in days) before the expiration when the token should be rotated. As an example, if set to 7 days, the token will rotate 7 days before the expiration date, but only when pulumi up is run in that timeframe.
    expirationDays Integer
    The duration (in days) the new token should be valid for.
    rotateBeforeDays number
    The duration (in days) before the expiration when the token should be rotated. As an example, if set to 7 days, the token will rotate 7 days before the expiration date, but only when pulumi up is run in that timeframe.
    expirationDays number
    The duration (in days) the new token should be valid for.
    rotate_before_days int
    The duration (in days) before the expiration when the token should be rotated. As an example, if set to 7 days, the token will rotate 7 days before the expiration date, but only when pulumi up is run in that timeframe.
    expiration_days int
    The duration (in days) the new token should be valid for.
    rotateBeforeDays Number
    The duration (in days) before the expiration when the token should be rotated. As an example, if set to 7 days, the token will rotate 7 days before the expiration date, but only when pulumi up is run in that timeframe.
    expirationDays Number
    The duration (in days) the new token should be valid for.

    Import

    Starting in Terraform v1.5.0, you can use an import block to import gitlab.ProjectServiceAccountAccessToken. For example:

    Importing using the CLI is supported with the following syntax:

    id is in the form of <project_id>:<service_account_id>:<access_token_id> Importing an access token does not import the access token value.

    $ pulumi import gitlab:index/projectServiceAccountAccessToken:ProjectServiceAccountAccessToken example 1:2:3

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    GitLab pulumi/pulumi-gitlab
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the gitlab Terraform Provider.
    gitlab logo
    Viewing docs for GitLab v10.2.0
    published on Wednesday, Aug 26, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-gitlab

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial