Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Incident Provider
  4. API Docs
  5. ApiKey
Viewing docs for incident 7.0.0
published on Friday, Sep 11, 2026 by incident-io
Schema (JSON)
incident-io/terraform-provider-incident

incident.ApiKey

Viewing docs for incident 7.0.0
published on Friday, Sep 11, 2026 by incident-io
Schema (JSON)
incident-io/terraform-provider-incident

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as incident from "@pulumi/incident";

// incident.io returns an API key's token when it issues one - on create, and on each
// rotation - and never again. Terraform keeps it in state, so anything that can read your
// state can read the token: treat the state file as the credential it now holds.
const ci = new incident.ApiKey("ci", {
    name: "CI deploy key",
    comments: "Requested in #ask-infra, used by the deploy pipeline",
    roleNames: [
        "viewer",
        "catalog_viewer",
    ],
});
export const ciApiKeyToken = ci.token;
// Rotating is asked for by changing token_version - conventionally by incrementing it.
// That's the change Terraform can see, since the token itself is invisible to a plan.
// The previous token keeps working for rotation_grace_period_minutes, giving whatever
// holds it a window to pick up the new one.
const rotatedQuarterly = new incident.ApiKey("rotated_quarterly", {
    name: "Terraform state reader",
    roleNames: ["viewer"],
    tokenVersion: 2,
    rotationGracePeriodMinutes: 60,
});
// A key can be scoped to particular teams instead of the whole account. team_ids says
// which teams, and team_role_names says what the key may do for them, so the two go
// together: set both, or neither. An account with no account-level roles leaves
// role_names out entirely.
const platformTeamSchedules = new incident.ApiKey("platform_team_schedules", {
    name: "Platform team schedule sync",
    teamIds: ["01G0J1EXE7AXZ2C93K61WBPYEH"],
    teamRoleNames: [
        "schedules_editor",
        "on_call_editor",
    ],
});
// Editing a key's roles never rotates it: the token outlives its permissions. Rotate
// deliberately if narrowing a key's scopes should also stop the old token being accepted.
const narrowed = new incident.ApiKey("narrowed", {
    name: "Read-only reporting key",
    roleNames: ["viewer"],
    tokenVersion: 3,
    rotationGracePeriodMinutes: 0,
});

    import pulumi
import pulumi_incident as incident

# incident.io returns an API key's token when it issues one - on create, and on each
# rotation - and never again. Terraform keeps it in state, so anything that can read your
# state can read the token: treat the state file as the credential it now holds.
ci = incident.ApiKey("ci",
    name="CI deploy key",
    comments="Requested in #ask-infra, used by the deploy pipeline",
    role_names=[
        "viewer",
        "catalog_viewer",
    ])
pulumi.export("ciApiKeyToken", ci.token)
# Rotating is asked for by changing token_version - conventionally by incrementing it.
# That's the change Terraform can see, since the token itself is invisible to a plan.
# The previous token keeps working for rotation_grace_period_minutes, giving whatever
# holds it a window to pick up the new one.
rotated_quarterly = incident.ApiKey("rotated_quarterly",
    name="Terraform state reader",
    role_names=["viewer"],
    token_version=2,
    rotation_grace_period_minutes=60)
# A key can be scoped to particular teams instead of the whole account. team_ids says
# which teams, and team_role_names says what the key may do for them, so the two go
# together: set both, or neither. An account with no account-level roles leaves
# role_names out entirely.
platform_team_schedules = incident.ApiKey("platform_team_schedules",
    name="Platform team schedule sync",
    team_ids=["01G0J1EXE7AXZ2C93K61WBPYEH"],
    team_role_names=[
        "schedules_editor",
        "on_call_editor",
    ])
# Editing a key's roles never rotates it: the token outlives its permissions. Rotate
# deliberately if narrowing a key's scopes should also stop the old token being accepted.
narrowed = incident.ApiKey("narrowed",
    name="Read-only reporting key",
    role_names=["viewer"],
    token_version=3,
    rotation_grace_period_minutes=0)

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/incident/v7/incident"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// incident.io returns an API key's token when it issues one - on create, and on each
		// rotation - and never again. Terraform keeps it in state, so anything that can read your
		// state can read the token: treat the state file as the credential it now holds.
		ci, err := incident.NewApiKey(ctx, "ci", &incident.ApiKeyArgs{
			Name:     pulumi.String("CI deploy key"),
			Comments: pulumi.String("Requested in #ask-infra, used by the deploy pipeline"),
			RoleNames: pulumi.StringArray{
				pulumi.String("viewer"),
				pulumi.String("catalog_viewer"),
			},
		})
		if err != nil {
			return err
		}
		ctx.Export("ciApiKeyToken", ci.Token)
		// Rotating is asked for by changing token_version - conventionally by incrementing it.
		// That's the change Terraform can see, since the token itself is invisible to a plan.
		// The previous token keeps working for rotation_grace_period_minutes, giving whatever
		// holds it a window to pick up the new one.
		_, err = incident.NewApiKey(ctx, "rotated_quarterly", &incident.ApiKeyArgs{
			Name: pulumi.String("Terraform state reader"),
			RoleNames: pulumi.StringArray{
				pulumi.String("viewer"),
			},
			TokenVersion:               pulumi.Float64(2),
			RotationGracePeriodMinutes: pulumi.Float64(60),
		})
		if err != nil {
			return err
		}
		// A key can be scoped to particular teams instead of the whole account. team_ids says
		// which teams, and team_role_names says what the key may do for them, so the two go
		// together: set both, or neither. An account with no account-level roles leaves
		// role_names out entirely.
		_, err = incident.NewApiKey(ctx, "platform_team_schedules", &incident.ApiKeyArgs{
			Name: pulumi.String("Platform team schedule sync"),
			TeamIds: pulumi.StringArray{
				pulumi.String("01G0J1EXE7AXZ2C93K61WBPYEH"),
			},
			TeamRoleNames: pulumi.StringArray{
				pulumi.String("schedules_editor"),
				pulumi.String("on_call_editor"),
			},
		})
		if err != nil {
			return err
		}
		// Editing a key's roles never rotates it: the token outlives its permissions. Rotate
		// deliberately if narrowing a key's scopes should also stop the old token being accepted.
		_, err = incident.NewApiKey(ctx, "narrowed", &incident.ApiKeyArgs{
			Name: pulumi.String("Read-only reporting key"),
			RoleNames: pulumi.StringArray{
				pulumi.String("viewer"),
			},
			TokenVersion:               pulumi.Float64(3),
			RotationGracePeriodMinutes: pulumi.Float64(0),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Incident = Pulumi.Incident;

return await Deployment.RunAsync(() => 
{
    // incident.io returns an API key's token when it issues one - on create, and on each
    // rotation - and never again. Terraform keeps it in state, so anything that can read your
    // state can read the token: treat the state file as the credential it now holds.
    var ci = new Incident.ApiKey("ci", new()
    {
        Name = "CI deploy key",
        Comments = "Requested in #ask-infra, used by the deploy pipeline",
        RoleNames = new[]
        {
            "viewer",
            "catalog_viewer",
        },
    });

    // Rotating is asked for by changing token_version - conventionally by incrementing it.
    // That's the change Terraform can see, since the token itself is invisible to a plan.
    // The previous token keeps working for rotation_grace_period_minutes, giving whatever
    // holds it a window to pick up the new one.
    var rotatedQuarterly = new Incident.ApiKey("rotated_quarterly", new()
    {
        Name = "Terraform state reader",
        RoleNames = new[]
        {
            "viewer",
        },
        TokenVersion = 2,
        RotationGracePeriodMinutes = 60,
    });

    // A key can be scoped to particular teams instead of the whole account. team_ids says
    // which teams, and team_role_names says what the key may do for them, so the two go
    // together: set both, or neither. An account with no account-level roles leaves
    // role_names out entirely.
    var platformTeamSchedules = new Incident.ApiKey("platform_team_schedules", new()
    {
        Name = "Platform team schedule sync",
        TeamIds = new[]
        {
            "01G0J1EXE7AXZ2C93K61WBPYEH",
        },
        TeamRoleNames = new[]
        {
            "schedules_editor",
            "on_call_editor",
        },
    });

    // Editing a key's roles never rotates it: the token outlives its permissions. Rotate
    // deliberately if narrowing a key's scopes should also stop the old token being accepted.
    var narrowed = new Incident.ApiKey("narrowed", new()
    {
        Name = "Read-only reporting key",
        RoleNames = new[]
        {
            "viewer",
        },
        TokenVersion = 3,
        RotationGracePeriodMinutes = 0,
    });

    return new Dictionary<string, object?>
    {
        ["ciApiKeyToken"] = ci.Token,
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.incident.ApiKey;
import com.pulumi.incident.ApiKeyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // incident.io returns an API key's token when it issues one - on create, and on each
        // rotation - and never again. Terraform keeps it in state, so anything that can read your
        // state can read the token: treat the state file as the credential it now holds.
        var ci = new ApiKey("ci", ApiKeyArgs.builder()
            .name("CI deploy key")
            .comments("Requested in #ask-infra, used by the deploy pipeline")
            .roleNames(            
                "viewer",
                "catalog_viewer")
            .build());

        ctx.export("ciApiKeyToken", ci.token());
        // Rotating is asked for by changing token_version - conventionally by incrementing it.
        // That's the change Terraform can see, since the token itself is invisible to a plan.
        // The previous token keeps working for rotation_grace_period_minutes, giving whatever
        // holds it a window to pick up the new one.
        var rotatedQuarterly = new ApiKey("rotatedQuarterly", ApiKeyArgs.builder()
            .name("Terraform state reader")
            .roleNames("viewer")
            .tokenVersion(2.0)
            .rotationGracePeriodMinutes(60.0)
            .build());

        // A key can be scoped to particular teams instead of the whole account. team_ids says
        // which teams, and team_role_names says what the key may do for them, so the two go
        // together: set both, or neither. An account with no account-level roles leaves
        // role_names out entirely.
        var platformTeamSchedules = new ApiKey("platformTeamSchedules", ApiKeyArgs.builder()
            .name("Platform team schedule sync")
            .teamIds("01G0J1EXE7AXZ2C93K61WBPYEH")
            .teamRoleNames(            
                "schedules_editor",
                "on_call_editor")
            .build());

        // Editing a key's roles never rotates it: the token outlives its permissions. Rotate
        // deliberately if narrowing a key's scopes should also stop the old token being accepted.
        var narrowed = new ApiKey("narrowed", ApiKeyArgs.builder()
            .name("Read-only reporting key")
            .roleNames("viewer")
            .tokenVersion(3.0)
            .rotationGracePeriodMinutes(0.0)
            .build());

    }
}

    resources:
  # incident.io returns an API key's token when it issues one - on create, and on each
  # rotation - and never again. Terraform keeps it in state, so anything that can read your
  # state can read the token: treat the state file as the credential it now holds.
  ci:
    type: incident:ApiKey
    properties:
      name: CI deploy key
      comments: 'Requested in #ask-infra, used by the deploy pipeline'
      roleNames:
        - viewer
        - catalog_viewer
  # Rotating is asked for by changing token_version - conventionally by incrementing it.
  # That's the change Terraform can see, since the token itself is invisible to a plan.
  # The previous token keeps working for rotation_grace_period_minutes, giving whatever
  # holds it a window to pick up the new one.
  rotatedQuarterly:
    type: incident:ApiKey
    name: rotated_quarterly
    properties:
      name: Terraform state reader
      roleNames:
        - viewer
      tokenVersion: 2
      rotationGracePeriodMinutes: 60
  # A key can be scoped to particular teams instead of the whole account. team_ids says
  # which teams, and team_role_names says what the key may do for them, so the two go
  # together: set both, or neither. An account with no account-level roles leaves
  # role_names out entirely.
  platformTeamSchedules:
    type: incident:ApiKey
    name: platform_team_schedules
    properties:
      name: Platform team schedule sync
      teamIds:
        - 01G0J1EXE7AXZ2C93K61WBPYEH
      teamRoleNames:
        - schedules_editor
        - on_call_editor
  # Editing a key's roles never rotates it: the token outlives its permissions. Rotate
  # deliberately if narrowing a key's scopes should also stop the old token being accepted.
  narrowed:
    type: incident:ApiKey
    properties:
      name: Read-only reporting key
      roleNames:
        - viewer
      tokenVersion: 3
      rotationGracePeriodMinutes: 0
outputs:
  # Pass the token on through a sensitive output rather than copying it around. Terraform
  # refuses to print an output built from a sensitive attribute unless you mark it too.
  ciApiKeyToken: ${ci.token}

    Example coming soon!

    Create ApiKey Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ApiKey(name: string, args?: ApiKeyArgs, opts?: CustomResourceOptions);
    @overload
def ApiKey(resource_name: str,
           args: Optional[ApiKeyArgs] = None,
           opts: Optional[ResourceOptions] = None)

@overload
def ApiKey(resource_name: str,
           opts: Optional[ResourceOptions] = None,
           comments: Optional[str] = None,
           name: Optional[str] = None,
           role_names: Optional[Sequence[str]] = None,
           rotation_grace_period_minutes: Optional[float] = None,
           team_ids: Optional[Sequence[str]] = None,
           team_role_names: Optional[Sequence[str]] = None,
           token_version: Optional[float] = None)
    func NewApiKey(ctx *Context, name string, args *ApiKeyArgs, opts ...ResourceOption) (*ApiKey, error)
    public ApiKey(string name, ApiKeyArgs? args = null, CustomResourceOptions? opts = null)
    public ApiKey(String name, ApiKeyArgs args)
public ApiKey(String name, ApiKeyArgs args, CustomResourceOptions options)

    type: incident:ApiKey
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "incident_api_key" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args ApiKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ApiKeyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ApiKeyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ApiKeyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ApiKeyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var apiKeyResource = new Incident.ApiKey("apiKeyResource", new()
{
    Comments = "string",
    Name = "string",
    RoleNames = new[]
    {
        "string",
    },
    RotationGracePeriodMinutes = 0.0,
    TeamIds = new[]
    {
        "string",
    },
    TeamRoleNames = new[]
    {
        "string",
    },
    TokenVersion = 0.0,
});

    example, err := incident.NewApiKey(ctx, "apiKeyResource", &incident.ApiKeyArgs{
	Comments: pulumi.String("string"),
	Name:     pulumi.String("string"),
	RoleNames: pulumi.StringArray{
		pulumi.String("string"),
	},
	RotationGracePeriodMinutes: pulumi.Float64(0),
	TeamIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	TeamRoleNames: pulumi.StringArray{
		pulumi.String("string"),
	},
	TokenVersion: pulumi.Float64(0),
})

    resource "incident_api_key" "apiKeyResource" {
  lifecycle {
    create_before_destroy = true
  }
  comments                      = "string"
  name                          = "string"
  role_names                    = ["string"]
  rotation_grace_period_minutes = 0
  team_ids                      = ["string"]
  team_role_names               = ["string"]
  token_version                 = 0
}

    var apiKeyResource = new ApiKey("apiKeyResource", ApiKeyArgs.builder()
    .comments("string")
    .name("string")
    .roleNames("string")
    .rotationGracePeriodMinutes(0.0)
    .teamIds("string")
    .teamRoleNames("string")
    .tokenVersion(0.0)
    .build());

    api_key_resource = incident.ApiKey("apiKeyResource",
    comments="string",
    name="string",
    role_names=["string"],
    rotation_grace_period_minutes=float(0),
    team_ids=["string"],
    team_role_names=["string"],
    token_version=float(0))

    const apiKeyResource = new incident.ApiKey("apiKeyResource", {
    comments: "string",
    name: "string",
    roleNames: ["string"],
    rotationGracePeriodMinutes: 0,
    teamIds: ["string"],
    teamRoleNames: ["string"],
    tokenVersion: 0,
});

    type: incident:ApiKey
properties:
    comments: string
    name: string
    roleNames:
        - string
    rotationGracePeriodMinutes: 0
    teamIds:
        - string
    teamRoleNames:
        - string
    tokenVersion: 0

    ApiKey Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ApiKey resource accepts the following input properties:

    Comments string
    Freeform notes about this API key
    Name string
    The name of the API key, for the user's reference
    RoleNames List<string>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    RotationGracePeriodMinutes double
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    TeamIds List<string>
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    TeamRoleNames List<string>

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    TokenVersion double
    Comments string
    Freeform notes about this API key
    Name string
    The name of the API key, for the user's reference
    RoleNames []string
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    RotationGracePeriodMinutes float64
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    TeamIds []string
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    TeamRoleNames []string

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    TokenVersion float64
    comments string
    Freeform notes about this API key
    name string
    The name of the API key, for the user's reference
    role_names list(string)
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotation_grace_period_minutes number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    team_ids list(string)
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    team_role_names list(string)

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    token_version number
    comments String
    Freeform notes about this API key
    name String
    The name of the API key, for the user's reference
    roleNames List<String>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes Double
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    teamIds List<String>
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames List<String>

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    tokenVersion Double
    comments string
    Freeform notes about this API key
    name string
    The name of the API key, for the user's reference
    roleNames string[]
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    teamIds string[]
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames string[]

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    tokenVersion number
    comments str
    Freeform notes about this API key
    name str
    The name of the API key, for the user's reference
    role_names Sequence[str]
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotation_grace_period_minutes float
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    team_ids Sequence[str]
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    team_role_names Sequence[str]

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    token_version float
    comments String
    Freeform notes about this API key
    name String
    The name of the API key, for the user's reference
    roleNames List<String>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes Number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    teamIds List<String>
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames List<String>

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    tokenVersion Number

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ApiKey resource produces the following output properties:

    CreatedAt string
    When the API key was created
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUsedAt string
    When the key was last used to authenticate a request
    Token string
    TokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    CreatedAt string
    When the API key was created
    Id string
    The provider-assigned unique ID for this managed resource.
    LastUsedAt string
    When the key was last used to authenticate a request
    Token string
    TokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    created_at string
    When the API key was created
    id string
    The provider-assigned unique ID for this managed resource.
    last_used_at string
    When the key was last used to authenticate a request
    token string
    token_last_issued_at string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    createdAt String
    When the API key was created
    id String
    The provider-assigned unique ID for this managed resource.
    lastUsedAt String
    When the key was last used to authenticate a request
    token String
    tokenLastIssuedAt String
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    createdAt string
    When the API key was created
    id string
    The provider-assigned unique ID for this managed resource.
    lastUsedAt string
    When the key was last used to authenticate a request
    token string
    tokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    created_at str
    When the API key was created
    id str
    The provider-assigned unique ID for this managed resource.
    last_used_at str
    When the key was last used to authenticate a request
    token str
    token_last_issued_at str
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    createdAt String
    When the API key was created
    id String
    The provider-assigned unique ID for this managed resource.
    lastUsedAt String
    When the key was last used to authenticate a request
    token String
    tokenLastIssuedAt String
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.

    Look up Existing ApiKey Resource

    Get an existing ApiKey resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ApiKeyState, opts?: CustomResourceOptions): ApiKey
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        comments: Optional[str] = None,
        created_at: Optional[str] = None,
        last_used_at: Optional[str] = None,
        name: Optional[str] = None,
        role_names: Optional[Sequence[str]] = None,
        rotation_grace_period_minutes: Optional[float] = None,
        team_ids: Optional[Sequence[str]] = None,
        team_role_names: Optional[Sequence[str]] = None,
        token: Optional[str] = None,
        token_last_issued_at: Optional[str] = None,
        token_version: Optional[float] = None) -> ApiKey
    func GetApiKey(ctx *Context, name string, id IDInput, state *ApiKeyState, opts ...ResourceOption) (*ApiKey, error)
    public static ApiKey Get(string name, Input<string> id, ApiKeyState? state, CustomResourceOptions? opts = null)
    public static ApiKey get(String name, Output<String> id, ApiKeyState state, CustomResourceOptions options)
    resources:  _:    type: incident:ApiKey    get:      id: ${id}
    import {
  to = incident_api_key.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Comments string
    Freeform notes about this API key
    CreatedAt string
    When the API key was created
    LastUsedAt string
    When the key was last used to authenticate a request
    Name string
    The name of the API key, for the user's reference
    RoleNames List<string>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    RotationGracePeriodMinutes double
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    TeamIds List<string>
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    TeamRoleNames List<string>

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    Token string
    TokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    TokenVersion double
    Comments string
    Freeform notes about this API key
    CreatedAt string
    When the API key was created
    LastUsedAt string
    When the key was last used to authenticate a request
    Name string
    The name of the API key, for the user's reference
    RoleNames []string
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    RotationGracePeriodMinutes float64
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    TeamIds []string
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    TeamRoleNames []string

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    Token string
    TokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    TokenVersion float64
    comments string
    Freeform notes about this API key
    created_at string
    When the API key was created
    last_used_at string
    When the key was last used to authenticate a request
    name string
    The name of the API key, for the user's reference
    role_names list(string)
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotation_grace_period_minutes number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    team_ids list(string)
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    team_role_names list(string)

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    token string
    token_last_issued_at string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    token_version number
    comments String
    Freeform notes about this API key
    createdAt String
    When the API key was created
    lastUsedAt String
    When the key was last used to authenticate a request
    name String
    The name of the API key, for the user's reference
    roleNames List<String>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes Double
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    teamIds List<String>
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames List<String>

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    token String
    tokenLastIssuedAt String
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    tokenVersion Double
    comments string
    Freeform notes about this API key
    createdAt string
    When the API key was created
    lastUsedAt string
    When the key was last used to authenticate a request
    name string
    The name of the API key, for the user's reference
    roleNames string[]
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    teamIds string[]
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames string[]

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    token string
    tokenLastIssuedAt string
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    tokenVersion number
    comments str
    Freeform notes about this API key
    created_at str
    When the API key was created
    last_used_at str
    When the key was last used to authenticate a request
    name str
    The name of the API key, for the user's reference
    role_names Sequence[str]
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotation_grace_period_minutes float
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    team_ids Sequence[str]
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    team_role_names Sequence[str]

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    token str
    token_last_issued_at str
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    token_version float
    comments String
    Freeform notes about this API key
    createdAt String
    When the API key was created
    lastUsedAt String
    When the key was last used to authenticate a request
    name String
    The name of the API key, for the user's reference
    roleNames List<String>
    Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
    rotationGracePeriodMinutes Number
    How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to token_version rotates the key.
    teamIds List<String>
    IDs of teams to scope the team_role_names to. If provided, team_role_names must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
    teamRoleNames List<String>

    Roles to grant for the teams specified in team_ids. If provided, team_ids must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.

    API key role name that may be granted for team-scoped access. Possible values are: catalog_editor, schedules_editor, schedules_reader, schedule_overrides_editor, on_call_editor, escalation_creator, api_keys_manage, workflows_editor, private_workflows_editor, secrets_manage, secrets_use, heartbeats_ping, telemetry_query_restricted, telemetry_data_source_update.

    token String
    tokenLastIssuedAt String
    When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
    tokenVersion Number

    Import

    Import is supported using an import block or the pulumi import command:

    The pulumi import command can be used, for example:

    #!/bin/bash

    Import an API key using its ID

    Replace the ID with a real ID from your incident.io organization

    $ pulumi import incident:index/apiKey:ApiKey example 01ABC123DEF456GHI789JKL

    An imported key has no token: the one it was issued with went to whoever created it and

    can’t be read back, so token is null. It has no token_version either, so a config that

    sets one will rotate the key on the first apply - which is also the only way to get a

    token for a key Terraform has adopted. The plan says so before it happens.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    incident incident-io/terraform-provider-incident
    License
    Notes
    This Pulumi package is based on the incident Terraform Provider.
    Viewing docs for incident 7.0.0
    published on Friday, Sep 11, 2026 by incident-io
    Schema (JSON)
    incident-io/terraform-provider-incident

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial