Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. incident.io
  4. API Docs
  5. ApiKey
Viewing docs for incident.io v0.4.0
published on Saturday, Oct 17, 2026 by incident-io
Schema (JSON)
incident-io/pulumi-incident

incident.ApiKey

incident logo incident.io
Viewing docs for incident.io v0.4.0
published on Saturday, Oct 17, 2026 by incident-io
Schema (JSON)
incident-io/pulumi-incident

    Manage API keys for your organization.

    This API lets you view, create, update, delete, and rotate API keys programmatically, including configuring account-level roles and roles scoped to specific teams.

    Common use cases include:

    • API key rotation: You can issue a new access token for any API key using the Rotate endpoint.
    • Managing keys at scale: use the Show, List, Create, Update, and Delete endpoints to automate API key lifecycle management.

    Permissions model

    To use these endpoints, your API key must have the apiKeysManage role granted at either the account level or for specific teams.

    In addition, the following rules apply, when a “caller” API key is managing a “target” API key:

    • A caller key can only assign roles whose scopes are a subset of its own scopes. For example, a key with viewer and incidentCreator can assign those roles to a target key, but cannot assign the incidentEditor role, since it has additional scopes.
    • The same applies at the team level: A caller key with schedulesEditor at the account level can create a target key with that role for a specific team, but a key with schedulesEditor only for one team (Team A, say) cannot assign it at the account level or for another team, Team B.
    • The apiKeysManage role cannot be assigned via the API. To create a key with that role, you must go to Settings → API keys in the dashboard, and click “Add new”, creating a key with the “View, create, edit, delete or rotate API keys” role (apiKeysManage).
    • The Delete endpoint does not check whether the calling API key holds the scopes of the key being deleted. However, a team-scoped key can only delete keys belonging to its teams.
    • To rotate the token of an API key, use the Rotate endpoint or by clicking “Rotate token” on any API key listed in the dashboard. The same permissions limitations apply as when creating or updating an API key.

    Finding role names and team IDs

    To find valid values for roleNames, teamIds, and teamRoleNames, go to Settings → API keys in the dashboard. Click to either edit an existing key or create a new one, select the desired roles and teams, and then use the copy button to get hold of the role and team identifiers as JSON.

    Manages an API key: the credential an integration authenticates to incident.io with, and the roles that decide what it may do.

    The token

    incident.io returns a key’s token when it issues one - when the key is created, and each time it is rotated - and at no other time. A read cannot recover it, so Terraform keeps it in state, in the token attribute. It is marked sensitive, so Terraform will not print it, but anything that can read your state can read the token: treat the state file as the credential it now contains, and pass token on to wherever it is needed through a sensitive output or variable rather than copying it around.

    A key adopted with pulumi import has no token, because the one it was created with is gone and cannot be re-read. Rotate it to get a token Terraform can hand on.

    Rotating

    tokenVersion is your own counter, and changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. The plan says so, token becomes known after apply, and the previous token keeps working for rotationGracePeriodMinutes so that whatever holds it has a window to pick up the new one.

    Editing a key’s roles or name never rotates it: the token outlives its permissions, and a key whose scopes you have just narrowed carries on working. Rotate deliberately if a permissions change means the old token should stop being accepted.

    Roles

    roleNames grants a role across the whole account. teamRoleNames grants roles only for the teams in teamIds, so those two go together: set both, or neither.

    incident.io will not let a key grant more than its own bearer holds, so the key running Terraform has to already have every role it assigns. It also refuses to assign apiKeysManage at all, which means a Terraform-managed key cannot itself manage keys.

    Neither rule is decided by this provider - which roles your own key holds is not something a configuration can know - so the plan asks incident.io whether the key it describes would be accepted. A role you cannot grant is reported when you plan, rather than part way through an apply. If that check cannot be reached the plan warns and carries on, so the rejection may still arrive at apply time.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as incident from "@incident-io/pulumi";

// incident.io returns an API key's token when it issues one - on create, and on each
// rotation - and never again. Terraform keeps it in state, so anything that can read your
// state can read the token: treat the state file as the credential it now holds.
const ci = new incident.ApiKey("ci", {
    name: "CI deploy key",
    comments: "Requested in #ask-infra, used by the deploy pipeline",
    roleNames: [
        "viewer",
        "catalog_viewer",
    ],
});
export const ciApiKeyToken = ci.token;
// Rotating is asked for by changing token_version - conventionally by incrementing it.
// That's the change Terraform can see, since the token itself is invisible to a plan.
// The previous token keeps working for rotation_grace_period_minutes, giving whatever
// holds it a window to pick up the new one.
const rotatedQuarterly = new incident.ApiKey("rotated_quarterly", {
    name: "Terraform state reader",
    roleNames: ["viewer"],
    tokenVersion: 2,
    rotationGracePeriodMinutes: 60,
});
// A key can be scoped to particular teams instead of the whole account. team_ids says
// which teams, and team_role_names says what the key may do for them, so the two go
// together: set both, or neither. An account with no account-level roles leaves
// role_names out entirely.
const platformTeamSchedules = new incident.ApiKey("platform_team_schedules", {
    name: "Platform team schedule sync",
    teamIds: ["01G0J1EXE7AXZ2C93K61WBPYEH"],
    teamRoleNames: [
        "schedules_editor",
        "on_call_editor",
    ],
});
// Editing a key's roles never rotates it: the token outlives its permissions. Rotate
// deliberately if narrowing a key's scopes should also stop the old token being accepted.
const narrowed = new incident.ApiKey("narrowed", {
    name: "Read-only reporting key",
    roleNames: ["viewer"],
    tokenVersion: 3,
    rotationGracePeriodMinutes: 0,
});

    import pulumi
import pulumi_incident as incident

# incident.io returns an API key's token when it issues one - on create, and on each
# rotation - and never again. Terraform keeps it in state, so anything that can read your
# state can read the token: treat the state file as the credential it now holds.
ci = incident.ApiKey("ci",
    name="CI deploy key",
    comments="Requested in #ask-infra, used by the deploy pipeline",
    role_names=[
        "viewer",
        "catalog_viewer",
    ])
pulumi.export("ciApiKeyToken", ci.token)
# Rotating is asked for by changing token_version - conventionally by incrementing it.
# That's the change Terraform can see, since the token itself is invisible to a plan.
# The previous token keeps working for rotation_grace_period_minutes, giving whatever
# holds it a window to pick up the new one.
rotated_quarterly = incident.ApiKey("rotated_quarterly",
    name="Terraform state reader",
    role_names=["viewer"],
    token_version=2,
    rotation_grace_period_minutes=60)
# A key can be scoped to particular teams instead of the whole account. team_ids says
# which teams, and team_role_names says what the key may do for them, so the two go
# together: set both, or neither. An account with no account-level roles leaves
# role_names out entirely.
platform_team_schedules = incident.ApiKey("platform_team_schedules",
    name="Platform team schedule sync",
    team_ids=["01G0J1EXE7AXZ2C93K61WBPYEH"],
    team_role_names=[
        "schedules_editor",
        "on_call_editor",
    ])
# Editing a key's roles never rotates it: the token outlives its permissions. Rotate
# deliberately if narrowing a key's scopes should also stop the old token being accepted.
narrowed = incident.ApiKey("narrowed",
    name="Read-only reporting key",
    role_names=["viewer"],
    token_version=3,
    rotation_grace_period_minutes=0)

    package main

import (
	"github.com/incident-io/pulumi-incident/sdk/go/incident"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// incident.io returns an API key's token when it issues one - on create, and on each
		// rotation - and never again. Terraform keeps it in state, so anything that can read your
		// state can read the token: treat the state file as the credential it now holds.
		ci, err := incident.NewApiKey(ctx, "ci", &incident.ApiKeyArgs{
			Name:     pulumi.String("CI deploy key"),
			Comments: pulumi.String("Requested in #ask-infra, used by the deploy pipeline"),
			RoleNames: pulumi.StringArray{
				pulumi.String("viewer"),
				pulumi.String("catalog_viewer"),
			},
		})
		if err != nil {
			return err
		}
		ctx.Export("ciApiKeyToken", ci.Token)
		// Rotating is asked for by changing token_version - conventionally by incrementing it.
		// That's the change Terraform can see, since the token itself is invisible to a plan.
		// The previous token keeps working for rotation_grace_period_minutes, giving whatever
		// holds it a window to pick up the new one.
		_, err = incident.NewApiKey(ctx, "rotated_quarterly", &incident.ApiKeyArgs{
			Name: pulumi.String("Terraform state reader"),
			RoleNames: pulumi.StringArray{
				pulumi.String("viewer"),
			},
			TokenVersion:               pulumi.Int(2),
			RotationGracePeriodMinutes: pulumi.Int(60),
		})
		if err != nil {
			return err
		}
		// A key can be scoped to particular teams instead of the whole account. team_ids says
		// which teams, and team_role_names says what the key may do for them, so the two go
		// together: set both, or neither. An account with no account-level roles leaves
		// role_names out entirely.
		_, err = incident.NewApiKey(ctx, "platform_team_schedules", &incident.ApiKeyArgs{
			Name: pulumi.String("Platform team schedule sync"),
			TeamIds: pulumi.StringArray{
				pulumi.String("01G0J1EXE7AXZ2C93K61WBPYEH"),
			},
			TeamRoleNames: pulumi.StringArray{
				pulumi.String("schedules_editor"),
				pulumi.String("on_call_editor"),
			},
		})
		if err != nil {
			return err
		}
		// Editing a key's roles never rotates it: the token outlives its permissions. Rotate
		// deliberately if narrowing a key's scopes should also stop the old token being accepted.
		_, err = incident.NewApiKey(ctx, "narrowed", &incident.ApiKeyArgs{
			Name: pulumi.String("Read-only reporting key"),
			RoleNames: pulumi.StringArray{
				pulumi.String("viewer"),
			},
			TokenVersion:               pulumi.Int(3),
			RotationGracePeriodMinutes: pulumi.Int(0),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Incident = Pulumi.Incident;

return await Deployment.RunAsync(() => 
{
    // incident.io returns an API key's token when it issues one - on create, and on each
    // rotation - and never again. Terraform keeps it in state, so anything that can read your
    // state can read the token: treat the state file as the credential it now holds.
    var ci = new Incident.ApiKey("ci", new()
    {
        Name = "CI deploy key",
        Comments = "Requested in #ask-infra, used by the deploy pipeline",
        RoleNames = new[]
        {
            "viewer",
            "catalog_viewer",
        },
    });

    // Rotating is asked for by changing token_version - conventionally by incrementing it.
    // That's the change Terraform can see, since the token itself is invisible to a plan.
    // The previous token keeps working for rotation_grace_period_minutes, giving whatever
    // holds it a window to pick up the new one.
    var rotatedQuarterly = new Incident.ApiKey("rotated_quarterly", new()
    {
        Name = "Terraform state reader",
        RoleNames = new[]
        {
            "viewer",
        },
        TokenVersion = 2,
        RotationGracePeriodMinutes = 60,
    });

    // A key can be scoped to particular teams instead of the whole account. team_ids says
    // which teams, and team_role_names says what the key may do for them, so the two go
    // together: set both, or neither. An account with no account-level roles leaves
    // role_names out entirely.
    var platformTeamSchedules = new Incident.ApiKey("platform_team_schedules", new()
    {
        Name = "Platform team schedule sync",
        TeamIds = new[]
        {
            "01G0J1EXE7AXZ2C93K61WBPYEH",
        },
        TeamRoleNames = new[]
        {
            "schedules_editor",
            "on_call_editor",
        },
    });

    // Editing a key's roles never rotates it: the token outlives its permissions. Rotate
    // deliberately if narrowing a key's scopes should also stop the old token being accepted.
    var narrowed = new Incident.ApiKey("narrowed", new()
    {
        Name = "Read-only reporting key",
        RoleNames = new[]
        {
            "viewer",
        },
        TokenVersion = 3,
        RotationGracePeriodMinutes = 0,
    });

    return new Dictionary<string, object?>
    {
        ["ciApiKeyToken"] = ci.Token,
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.incident.ApiKey;
import com.pulumi.incident.ApiKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // incident.io returns an API key's token when it issues one - on create, and on each
        // rotation - and never again. Terraform keeps it in state, so anything that can read your
        // state can read the token: treat the state file as the credential it now holds.
        var ci = new ApiKey("ci", ApiKeyArgs.builder()
            .name("CI deploy key")
            .comments("Requested in #ask-infra, used by the deploy pipeline")
            .roleNames(            
                "viewer",
                "catalog_viewer")
            .build());

        ctx.export("ciApiKeyToken", ci.token());
        // Rotating is asked for by changing token_version - conventionally by incrementing it.
        // That's the change Terraform can see, since the token itself is invisible to a plan.
        // The previous token keeps working for rotation_grace_period_minutes, giving whatever
        // holds it a window to pick up the new one.
        var rotatedQuarterly = new ApiKey("rotatedQuarterly", ApiKeyArgs.builder()
            .name("Terraform state reader")
            .roleNames("viewer")
            .tokenVersion(2)
            .rotationGracePeriodMinutes(60)
            .build());

        // A key can be scoped to particular teams instead of the whole account. team_ids says
        // which teams, and team_role_names says what the key may do for them, so the two go
        // together: set both, or neither. An account with no account-level roles leaves
        // role_names out entirely.
        var platformTeamSchedules = new ApiKey("platformTeamSchedules", ApiKeyArgs.builder()
            .name("Platform team schedule sync")
            .teamIds("01G0J1EXE7AXZ2C93K61WBPYEH")
            .teamRoleNames(            
                "schedules_editor",
                "on_call_editor")
            .build());

        // Editing a key's roles never rotates it: the token outlives its permissions. Rotate
        // deliberately if narrowing a key's scopes should also stop the old token being accepted.
        var narrowed = new ApiKey("narrowed", ApiKeyArgs.builder()
            .name("Read-only reporting key")
            .roleNames("viewer")
            .tokenVersion(3)
            .rotationGracePeriodMinutes(0)
            .build());

    }
}

    resources:
  # incident.io returns an API key's token when it issues one - on create, and on each
  # rotation - and never again. Terraform keeps it in state, so anything that can read your
  # state can read the token: treat the state file as the credential it now holds.
  ci:
    type: incident:ApiKey
    properties:
      name: CI deploy key
      comments: 'Requested in #ask-infra, used by the deploy pipeline'
      roleNames:
        - viewer
        - catalog_viewer
  # Rotating is asked for by changing token_version - conventionally by incrementing it.
  # That's the change Terraform can see, since the token itself is invisible to a plan.
  # The previous token keeps working for rotation_grace_period_minutes, giving whatever
  # holds it a window to pick up the new one.
  rotatedQuarterly:
    type: incident:ApiKey
    name: rotated_quarterly
    properties:
      name: Terraform state reader
      roleNames:
        - viewer
      tokenVersion: 2
      rotationGracePeriodMinutes: 60
  # A key can be scoped to particular teams instead of the whole account. team_ids says
  # which teams, and team_role_names says what the key may do for them, so the two go
  # together: set both, or neither. An account with no account-level roles leaves
  # role_names out entirely.
  platformTeamSchedules:
    type: incident:ApiKey
    name: platform_team_schedules
    properties:
      name: Platform team schedule sync
      teamIds:
        - 01G0J1EXE7AXZ2C93K61WBPYEH
      teamRoleNames:
        - schedules_editor
        - on_call_editor
  # Editing a key's roles never rotates it: the token outlives its permissions. Rotate
  # deliberately if narrowing a key's scopes should also stop the old token being accepted.
  narrowed:
    type: incident:ApiKey
    properties:
      name: Read-only reporting key
      roleNames:
        - viewer
      tokenVersion: 3
      rotationGracePeriodMinutes: 0
outputs:
  # Pass the token on through a sensitive output rather than copying it around. Terraform
  # refuses to print an output built from a sensitive attribute unless you mark it too.
  ciApiKeyToken: ${ci.token}

    pulumi {
  required_providers {
    incident = {
      source = "pulumi/incident"
    }
  }
}

# incident.io returns an API key's token when it issues one - on create, and on each
# rotation - and never again. Terraform keeps it in state, so anything that can read your
# state can read the token: treat the state file as the credential it now holds.
resource "incident_apikey" "ci" {
  name       = "CI deploy key"
  comments   = "Requested in #ask-infra, used by the deploy pipeline"
  role_names = ["viewer", "catalog_viewer"]
}
# Rotating is asked for by changing token_version - conventionally by incrementing it.
# That's the change Terraform can see, since the token itself is invisible to a plan.
# The previous token keeps working for rotation_grace_period_minutes, giving whatever
# holds it a window to pick up the new one.
resource "incident_apikey" "rotated_quarterly" {
  name                          = "Terraform state reader"
  role_names                    = ["viewer"]
  token_version                 = 2
  rotation_grace_period_minutes = 60
}
# A key can be scoped to particular teams instead of the whole account. team_ids says
# which teams, and team_role_names says what the key may do for them, so the two go
# together: set both, or neither. An account with no account-level roles leaves
# role_names out entirely.
resource "incident_apikey" "platform_team_schedules" {
  name            = "Platform team schedule sync"
  team_ids        = ["01G0J1EXE7AXZ2C93K61WBPYEH"]
  team_role_names = ["schedules_editor", "on_call_editor"]
}
# Editing a key's roles never rotates it: the token outlives its permissions. Rotate
# deliberately if narrowing a key's scopes should also stop the old token being accepted.
resource "incident_apikey" "narrowed" {
  name                          = "Read-only reporting key"
  role_names                    = ["viewer"]
  token_version                 = 3
  rotation_grace_period_minutes = 0
}
# Pass the token on through a sensitive output rather than copying it around. Terraform
# refuses to print an output built from a sensitive attribute unless you mark it too.
output "ciApiKeyToken" {
  value = incident_apikey.ci.token
}

    Create ApiKey Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ApiKey(name: string, args?: ApiKeyArgs, opts?: CustomResourceOptions);
    @overload
def ApiKey(resource_name: str,
           args: Optional[ApiKeyArgs] = None,
           opts: Optional[ResourceOptions] = None)

@overload
def ApiKey(resource_name: str,
           opts: Optional[ResourceOptions] = None,
           comments: Optional[str] = None,
           name: Optional[str] = None,
           role_names: Optional[Sequence[str]] = None,
           rotation_grace_period_minutes: Optional[int] = None,
           team_ids: Optional[Sequence[str]] = None,
           team_role_names: Optional[Sequence[str]] = None,
           token_version: Optional[int] = None,
           unlock_in_dashboard: Optional[bool] = None)
    func NewApiKey(ctx *Context, name string, args *ApiKeyArgs, opts ...ResourceOption) (*ApiKey, error)
    public ApiKey(string name, ApiKeyArgs? args = null, CustomResourceOptions? opts = null)
    public ApiKey(String name, ApiKeyArgs args)
public ApiKey(String name, ApiKeyArgs args, CustomResourceOptions options)

    type: incident:ApiKey
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "incident_api_key" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args ApiKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ApiKeyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ApiKeyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ApiKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ApiKeyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var apiKeyResource = new Incident.ApiKey("apiKeyResource", new()
{
    Comments = "string",
    Name = "string",
    RoleNames = new[]
    {
        "string",
    },
    RotationGracePeriodMinutes = 0,
    TeamIds = new[]
    {
        "string",
    },
    TeamRoleNames = new[]
    {
        "string",
    },
    TokenVersion = 0,
    UnlockInDashboard = false,
});

    example, err := incident.NewApiKey(ctx, "apiKeyResource", &incident.ApiKeyArgs{
	Comments: pulumi.String("string"),
	Name:     pulumi.String("string"),
	RoleNames: pulumi.StringArray{
		pulumi.String("string"),
	},
	RotationGracePeriodMinutes: pulumi.Int(0),
	TeamIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	TeamRoleNames: pulumi.StringArray{
		pulumi.String("string"),
	},
	TokenVersion:      pulumi.Int(0),
	UnlockInDashboard: pulumi.Bool(false),
})

    resource "incident_api_key" "apiKeyResource" {
  lifecycle {
    create_before_destroy = true
  }
  comments                      = "string"
  name                          = "string"
  role_names                    = ["string"]
  rotation_grace_period_minutes = 0
  team_ids                      = ["string"]
  team_role_names               = ["string"]
  token_version                 = 0
  unlock_in_dashboard           = false
}

    var apiKeyResource = new ApiKey("apiKeyResource", ApiKeyArgs.builder()
    .comments("string")
    .name("string")
    .roleNames("string")
    .rotationGracePeriodMinutes(0)
    .teamIds("string")
    .teamRoleNames("string")
    .tokenVersion(0)
    .unlockInDashboard(false)
    .build());

    api_key_resource = incident.ApiKey("apiKeyResource",
    comments="string",
    name="string",
    role_names=["string"],
    rotation_grace_period_minutes=0,
    team_ids=["string"],
    team_role_names=["string"],
    token_version=0,
    unlock_in_dashboard=False)

    const apiKeyResource = new incident.ApiKey("apiKeyResource", {
    comments: "string",
    name: "string",
    roleNames: ["string"],
    rotationGracePeriodMinutes: 0,
    teamIds: ["string"],
    teamRoleNames: ["string"],
    tokenVersion: 0,
    unlockInDashboard: false,
});

    type: incident:ApiKey
properties:
    comments: string
    name: string
    roleNames:
        - string
    rotationGracePeriodMinutes: 0
    teamIds:
        - string
    teamRoleNames:
        - string
    tokenVersion: 0
    unlockInDashboard: false

    ApiKey Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ApiKey resource accepts the following input properties:

    Comments string
    Freeform notes about this API key
    Name string
    The name of the API key, for the user's reference
    RoleNames List<string>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    RotationGracePeriodMinutes int
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    TeamIds List<string>
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    TeamRoleNames List<string>

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    TokenVersion int
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    UnlockInDashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    Comments string
    Freeform notes about this API key
    Name string
    The name of the API key, for the user's reference
    RoleNames []string
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    RotationGracePeriodMinutes int
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    TeamIds []string
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    TeamRoleNames []string

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    TokenVersion int
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    UnlockInDashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    comments string
    Freeform notes about this API key
    name string
    The name of the API key, for the user's reference
    role_names list(string)
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotation_grace_period_minutes number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    team_ids list(string)
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    team_role_names list(string)

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    token_version number
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    unlock_in_dashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    comments String
    Freeform notes about this API key
    name String
    The name of the API key, for the user's reference
    roleNames List<String>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes Integer
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    teamIds List<String>
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames List<String>

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    tokenVersion Integer
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    unlockInDashboard Boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    comments string
    Freeform notes about this API key
    name string
    The name of the API key, for the user's reference
    roleNames string[]
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    teamIds string[]
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames string[]

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    tokenVersion number
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    unlockInDashboard boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    comments str
    Freeform notes about this API key
    name str
    The name of the API key, for the user's reference
    role_names Sequence[str]
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotation_grace_period_minutes int
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    team_ids Sequence[str]
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    team_role_names Sequence[str]

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    token_version int
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    unlock_in_dashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    comments String
    Freeform notes about this API key
    name String
    The name of the API key, for the user's reference
    roleNames List<String>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes Number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    teamIds List<String>
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames List<String>

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    tokenVersion Number
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    unlockInDashboard Boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ApiKey resource produces the following output properties:

    CreatedAt string
    When the API key was created
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUsedAt string
    When the key was last used to authenticate a request
    Token string
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    TokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    CreatedAt string
    When the API key was created
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUsedAt string
    When the key was last used to authenticate a request
    Token string
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    TokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    created_at string
    When the API key was created
    id string
    The provider-assigned unique ID for this managed resource.
    last_used_at string
    When the key was last used to authenticate a request
    token string
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    token_last_issued_at string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    createdAt String
    When the API key was created
    id String
    The provider-assigned unique ID for this managed resource.
    lastUsedAt String
    When the key was last used to authenticate a request
    token String
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    tokenLastIssuedAt String
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    createdAt string
    When the API key was created
    id string
    The provider-assigned unique ID for this managed resource.
    lastUsedAt string
    When the key was last used to authenticate a request
    token string
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    tokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    created_at str
    When the API key was created
    id str
    The provider-assigned unique ID for this managed resource.
    last_used_at str
    When the key was last used to authenticate a request
    token str
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    token_last_issued_at str
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    createdAt String
    When the API key was created
    id String
    The provider-assigned unique ID for this managed resource.
    lastUsedAt String
    When the key was last used to authenticate a request
    token String
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    tokenLastIssuedAt String
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.

    Look up Existing ApiKey Resource

    Get an existing ApiKey resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ApiKeyState, opts?: CustomResourceOptions): ApiKey
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        comments: Optional[str] = None,
        created_at: Optional[str] = None,
        last_used_at: Optional[str] = None,
        name: Optional[str] = None,
        role_names: Optional[Sequence[str]] = None,
        rotation_grace_period_minutes: Optional[int] = None,
        team_ids: Optional[Sequence[str]] = None,
        team_role_names: Optional[Sequence[str]] = None,
        token: Optional[str] = None,
        token_last_issued_at: Optional[str] = None,
        token_version: Optional[int] = None,
        unlock_in_dashboard: Optional[bool] = None) -> ApiKey
    func GetApiKey(ctx *Context, name string, id IDInput, state *ApiKeyState, opts ...ResourceOption) (*ApiKey, error)
    public static ApiKey Get(string name, Input<string> id, ApiKeyState? state, CustomResourceOptions? opts = null)
    public static ApiKey get(String name, Output<String> id, ApiKeyState state, CustomResourceOptions options)
    resources:  _:    type: incident:ApiKey    get:      id: ${id}
    import {
  to = incident_api_key.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Comments string
    Freeform notes about this API key
    CreatedAt string
    When the API key was created
    LastUsedAt string
    When the key was last used to authenticate a request
    Name string
    The name of the API key, for the user's reference
    RoleNames List<string>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    RotationGracePeriodMinutes int
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    TeamIds List<string>
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    TeamRoleNames List<string>

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    Token string
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    TokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    TokenVersion int
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    UnlockInDashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    Comments string
    Freeform notes about this API key
    CreatedAt string
    When the API key was created
    LastUsedAt string
    When the key was last used to authenticate a request
    Name string
    The name of the API key, for the user's reference
    RoleNames []string
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    RotationGracePeriodMinutes int
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    TeamIds []string
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    TeamRoleNames []string

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    Token string
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    TokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    TokenVersion int
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    UnlockInDashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    comments string
    Freeform notes about this API key
    created_at string
    When the API key was created
    last_used_at string
    When the key was last used to authenticate a request
    name string
    The name of the API key, for the user's reference
    role_names list(string)
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotation_grace_period_minutes number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    team_ids list(string)
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    team_role_names list(string)

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    token string
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    token_last_issued_at string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    token_version number
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    unlock_in_dashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    comments String
    Freeform notes about this API key
    createdAt String
    When the API key was created
    lastUsedAt String
    When the key was last used to authenticate a request
    name String
    The name of the API key, for the user's reference
    roleNames List<String>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes Integer
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    teamIds List<String>
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames List<String>

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    token String
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    tokenLastIssuedAt String
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    tokenVersion Integer
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    unlockInDashboard Boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    comments string
    Freeform notes about this API key
    createdAt string
    When the API key was created
    lastUsedAt string
    When the key was last used to authenticate a request
    name string
    The name of the API key, for the user's reference
    roleNames string[]
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    teamIds string[]
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames string[]

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    token string
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    tokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    tokenVersion number
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    unlockInDashboard boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    comments str
    Freeform notes about this API key
    created_at str
    When the API key was created
    last_used_at str
    When the key was last used to authenticate a request
    name str
    The name of the API key, for the user's reference
    role_names Sequence[str]
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotation_grace_period_minutes int
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    team_ids Sequence[str]
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    team_role_names Sequence[str]

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    token str
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    token_last_issued_at str
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    token_version int
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    unlock_in_dashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    comments String
    Freeform notes about this API key
    createdAt String
    When the API key was created
    lastUsedAt String
    When the key was last used to authenticate a request
    name String
    The name of the API key, for the user's reference
    roleNames List<String>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes Number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to tokenVersion rotates the key.
    teamIds List<String>
    IDs of teams to scope the teamRoleNames to. If provided, teamRoleNames must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames List<String>

    Roles to grant for the teams specified in teamIds. If provided, teamIds must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalogEditor, schedulesEditor, schedulesReader, scheduleOverridesEditor, onCallEditor, escalationCreator, apiKeysManage, workflowsEditor, privateWorkflowsEditor, secretsManage, secretsUse, heartbeatsPing, telemetryQueryRestricted, telemetryDataSourceUpdate.

    token String
    The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with terraform import, whose token was issued before Terraform knew about it - rotate the key to get one.
    tokenLastIssuedAt String
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    tokenVersion Number
    The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
    unlockInDashboard Boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.

    Import

    Import is supported using an import block or the pulumi import command:

    The pulumi import command can be used, for example:

    !/bin/bash

    Import an API key using its ID Replace the ID with a real ID from your incident.io organization

    $ pulumi import incident:index/apiKey:ApiKey example 01ABC123DEF456GHI789JKL

    An imported key has no token: the one it was issued with went to whoever created it and can’t be read back, so token is null. It has no tokenVersion either, so a config that sets one will rotate the key on the first apply - which is also the only way to get a token for a key Terraform has adopted. The plan says so before it happens.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    incident incident-io/pulumi-incident
    License
    MIT
    Notes
    This Pulumi package is based on the incident Terraform Provider.
    incident logo incident.io
    Viewing docs for incident.io v0.4.0
    published on Saturday, Oct 17, 2026 by incident-io
    Schema (JSON)
    incident-io/pulumi-incident

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial