Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. incident.io
  4. API Docs
  5. Secret
Viewing docs for incident.io v0.4.0
published on Saturday, Oct 17, 2026 by incident-io
Schema (JSON)
incident-io/pulumi-incident

incident.Secret

incident logo incident.io
Viewing docs for incident.io v0.4.0
published on Saturday, Oct 17, 2026 by incident-io
Schema (JSON)
incident-io/pulumi-incident

    Manage secrets: named credentials that workflows can reference. A secret’s value can be set and rotated but is never returned by the API.

    A secret’s value is write-only: incident.io stores it encrypted and never returns it, so Terraform cannot read it back to compare against your configuration. Set it with valueWo, a write-only attribute, which needs Terraform 1.11 or OpenTofu 1.11 and above. The value is never written to state or to a plan file.

    Because the value is invisible to Terraform, changing valueWo on its own does nothing. Rotating a secret means changing valueWoVersion as well, conventionally by incrementing it: that is the change Terraform can see, and it is what asks incident.io to rotate. A rotation replaces the value and advances version; the previous value is retired and cannot be recovered.

    Both value attributes are optional after the secret exists, so Terraform can own a secret’s name, description and owning teams while something else rotates it. Leave them unset and the value is never touched.

    Example - Manage a secret

    import * as pulumi from "@pulumi/pulumi";
import * as incident from "@incident-io/pulumi";

const config = new pulumi.Config();
const pagerdutyWebhookToken = config.require("pagerdutyWebhookToken");
const pagerdutyWebhookTokenSecret = new incident.Secret("pagerduty_webhook_token", {
    name: "PagerDuty webhook token",
    description: "Auth token for the PagerDuty outgoing webhook",
    valueWo: pagerdutyWebhookToken,
    valueWoVersion: 1,
});
const billingApiKey = config.require("billingApiKey");
const billingApiKeySecret = new incident.Secret("billing_api_key", {
    name: "Billing API key",
    valueWo: billingApiKey,
    valueWoVersion: 1,
    owningTeamIds: ["01G0J1EXE7AXZ2C93K61WBPYEH"],
});
// Terraform doesn't have to own the value. Leave both value attributes off an existing
// secret and Terraform manages its name, description and owning teams while something
// else - the dashboard, or a rotation job - looks after the value.
const rotatedElsewhere = new incident.Secret("rotated_elsewhere", {
    name: "Datadog API key",
    description: "Rotated nightly by our key-rotation job",
});

    import pulumi
import pulumi_incident as incident

config = pulumi.Config()
pagerduty_webhook_token = config.require("pagerdutyWebhookToken")
pagerduty_webhook_token_secret = incident.Secret("pagerduty_webhook_token",
    name="PagerDuty webhook token",
    description="Auth token for the PagerDuty outgoing webhook",
    value_wo=pagerduty_webhook_token,
    value_wo_version=1)
billing_api_key = config.require("billingApiKey")
billing_api_key_secret = incident.Secret("billing_api_key",
    name="Billing API key",
    value_wo=billing_api_key,
    value_wo_version=1,
    owning_team_ids=["01G0J1EXE7AXZ2C93K61WBPYEH"])
# Terraform doesn't have to own the value. Leave both value attributes off an existing
# secret and Terraform manages its name, description and owning teams while something
# else - the dashboard, or a rotation job - looks after the value.
rotated_elsewhere = incident.Secret("rotated_elsewhere",
    name="Datadog API key",
    description="Rotated nightly by our key-rotation job")

    package main

import (
	"github.com/incident-io/pulumi-incident/sdk/go/incident"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		cfg := config.New(ctx, "")
		pagerdutyWebhookToken := cfg.Require("pagerdutyWebhookToken")
		_, err := incident.NewSecret(ctx, "pagerduty_webhook_token", &incident.SecretArgs{
			Name:           pulumi.String("PagerDuty webhook token"),
			Description:    pulumi.String("Auth token for the PagerDuty outgoing webhook"),
			ValueWo:        pulumi.String(pagerdutyWebhookToken),
			ValueWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		billingApiKey := cfg.Require("billingApiKey")
		_, err = incident.NewSecret(ctx, "billing_api_key", &incident.SecretArgs{
			Name:           pulumi.String("Billing API key"),
			ValueWo:        pulumi.String(billingApiKey),
			ValueWoVersion: pulumi.Int(1),
			OwningTeamIds: pulumi.StringArray{
				pulumi.String("01G0J1EXE7AXZ2C93K61WBPYEH"),
			},
		})
		if err != nil {
			return err
		}
		// Terraform doesn't have to own the value. Leave both value attributes off an existing
		// secret and Terraform manages its name, description and owning teams while something
		// else - the dashboard, or a rotation job - looks after the value.
		_, err = incident.NewSecret(ctx, "rotated_elsewhere", &incident.SecretArgs{
			Name:        pulumi.String("Datadog API key"),
			Description: pulumi.String("Rotated nightly by our key-rotation job"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Incident = Pulumi.Incident;

return await Deployment.RunAsync(() => 
{
    var config = new Config();
    var pagerdutyWebhookToken = config.Require("pagerdutyWebhookToken");
    var pagerdutyWebhookTokenSecret = new Incident.Secret("pagerduty_webhook_token", new()
    {
        Name = "PagerDuty webhook token",
        Description = "Auth token for the PagerDuty outgoing webhook",
        ValueWo = pagerdutyWebhookToken,
        ValueWoVersion = 1,
    });

    var billingApiKey = config.Require("billingApiKey");
    var billingApiKeySecret = new Incident.Secret("billing_api_key", new()
    {
        Name = "Billing API key",
        ValueWo = billingApiKey,
        ValueWoVersion = 1,
        OwningTeamIds = new[]
        {
            "01G0J1EXE7AXZ2C93K61WBPYEH",
        },
    });

    // Terraform doesn't have to own the value. Leave both value attributes off an existing
    // secret and Terraform manages its name, description and owning teams while something
    // else - the dashboard, or a rotation job - looks after the value.
    var rotatedElsewhere = new Incident.Secret("rotated_elsewhere", new()
    {
        Name = "Datadog API key",
        Description = "Rotated nightly by our key-rotation job",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.incident.Secret;
import com.pulumi.incident.SecretArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var config = ctx.config();
        final var pagerdutyWebhookToken = config.require("pagerdutyWebhookToken");
        var pagerdutyWebhookTokenSecret = new Secret("pagerdutyWebhookTokenSecret", SecretArgs.builder()
            .name("PagerDuty webhook token")
            .description("Auth token for the PagerDuty outgoing webhook")
            .valueWo(pagerdutyWebhookToken)
            .valueWoVersion(1)
            .build());

        final var billingApiKey = config.require("billingApiKey");
        var billingApiKeySecret = new Secret("billingApiKeySecret", SecretArgs.builder()
            .name("Billing API key")
            .valueWo(billingApiKey)
            .valueWoVersion(1)
            .owningTeamIds("01G0J1EXE7AXZ2C93K61WBPYEH")
            .build());

        // Terraform doesn't have to own the value. Leave both value attributes off an existing
        // secret and Terraform manages its name, description and owning teams while something
        // else - the dashboard, or a rotation job - looks after the value.
        var rotatedElsewhere = new Secret("rotatedElsewhere", SecretArgs.builder()
            .name("Datadog API key")
            .description("Rotated nightly by our key-rotation job")
            .build());

    }
}

    configuration:
  # A secret's value is write-only: it's sent to incident.io and never written to state or
  # to a plan file. Setting it needs Terraform 1.11 or OpenTofu 1.11 and above.
  #
  # Terraform can't see the value change, so rotating a secret means changing
  # value_wo_version too - conventionally by incrementing it. That's the change Terraform
  # can see, and it's what asks incident.io to rotate.
  pagerdutyWebhookToken:
    type: string
  # Secrets can be owned by teams, which is what governs who can rotate or delete them.
  # An owning team is a catalog entry of your Team catalog type.
  billingApiKey:
    type: string
resources:
  pagerdutyWebhookTokenSecret:
    type: incident:Secret
    name: pagerduty_webhook_token
    properties:
      name: PagerDuty webhook token
      description: Auth token for the PagerDuty outgoing webhook
      valueWo: ${pagerdutyWebhookToken}
      valueWoVersion: 1
  billingApiKeySecret:
    type: incident:Secret
    name: billing_api_key
    properties:
      name: Billing API key
      valueWo: ${billingApiKey}
      valueWoVersion: 1
      owningTeamIds:
        - 01G0J1EXE7AXZ2C93K61WBPYEH
  # Terraform doesn't have to own the value. Leave both value attributes off an existing
  # secret and Terraform manages its name, description and owning teams while something
  # else - the dashboard, or a rotation job - looks after the value.
  rotatedElsewhere:
    type: incident:Secret
    name: rotated_elsewhere
    properties:
      name: Datadog API key
      description: Rotated nightly by our key-rotation job

    pulumi {
  required_providers {
    incident = {
      source = "pulumi/incident"
    }
  }
}

resource "incident_secret" "pagerduty_webhook_token" {
  name             = "PagerDuty webhook token"
  description      = "Auth token for the PagerDuty outgoing webhook"
  value_wo         = var.pagerdutyWebhookToken
  value_wo_version = 1
}
resource "incident_secret" "billing_api_key" {
  name             = "Billing API key"
  value_wo         = var.billingApiKey
  value_wo_version = 1
  owning_team_ids  = ["01G0J1EXE7AXZ2C93K61WBPYEH"]
}
# Terraform doesn't have to own the value. Leave both value attributes off an existing
# secret and Terraform manages its name, description and owning teams while something
# else - the dashboard, or a rotation job - looks after the value.
resource "incident_secret" "rotated_elsewhere" {
  name        = "Datadog API key"
  description = "Rotated nightly by our key-rotation job"
}
# A secret's value is write-only: it's sent to incident.io and never written to state or
# to a plan file. Setting it needs Terraform 1.11 or OpenTofu 1.11 and above.
#
# Terraform can't see the value change, so rotating a secret means changing
# value_wo_version too - conventionally by incrementing it. That's the change Terraform
# can see, and it's what asks incident.io to rotate.
variable "pagerdutyWebhookToken" {
  type = string
}
# Secrets can be owned by teams, which is what governs who can rotate or delete them.
# An owning team is a catalog entry of your Team catalog type.
variable "billingApiKey" {
  type = string
}

    Example - Use a secret in a workflow’s webhook step

    import * as pulumi from "@pulumi/pulumi";
import * as incident from "@incident-io/pulumi";

const config = new pulumi.Config();
const partnerWebhookToken = config.require("partnerWebhookToken");
const partnerWebhookTokenSecret = new incident.Secret("partner_webhook_token", {
    name: "Partner webhook token",
    description: "Bearer token for the partner's incident webhook",
    valueWo: partnerWebhookToken,
    valueWoVersion: 1,
});
// The first way: put the secret's value inside a field's text.
//
// A field whose feature set ends in `_with_secrets` - which the webhook step's headers do -
// accepts a variable naming a secret by ID, and incident.io substitutes the value when the
// workflow runs. Write it as `{{ <secret id> }}` and reference the secret's `id`, never its
// value: Terraform is arranging for the value to be used, not handling it.
const authorizationHeader = incident.getRichTextOutput({
    markdown: pulumi.interpolate`Authorization: Bearer {{ ${partnerWebhookTokenSecret.id} }}`,
    featureSet: "plain_single_line_with_secrets",
});
const contentTypeHeader = incident.getRichText({
    markdown: "Content-Type: application/json",
    featureSet: "plain_single_line_with_secrets",
});
const webhookEndpoint = incident.getRichText({
    markdown: "https://partner.example.com/hooks/incident",
    featureSet: "plain_single_line",
});
const webhookBody = incident.getRichText({
    markdown: "{{ incident.name }} is now {{ incident.status }} at severity {{ incident.severity }}.\n",
    featureSet: "rich",
});
const notifyPartner = new incident.Workflow("notify_partner", {
    name: "Notify our partner of incident updates",
    trigger: "incident.updated",
    expressions: [],
    conditionGroups: [],
    steps: [{
        id: "01K5TSNDBF7KBZY9AFDKYXJM3N",
        name: "webhook.send",
        paramBindings: [
            {
                valueLiteral: webhookEndpoint.then(webhookEndpoint => webhookEndpoint.json),
            },
            {
                valueLiteral: "POST",
            },
            {
                values: [
                    authorizationHeader.json,
                    contentTypeHeader.then(contentTypeHeader => contentTypeHeader.json),
                ],
            },
            {
                valueLiteral: webhookBody.then(webhookBody => webhookBody.json),
            },
            {
                valueLiteral: partnerWebhookTokenSecret.id,
            },
            {},
            {},
        ],
    }],
    onceFors: ["incident"],
    privateIncidentScope: "none",
    continueOnStepError: false,
    runsOnIncidents: "newly_created_and_active",
    runsOnIncidentModes: ["standard"],
    state: "draft",
});

    import pulumi
import pulumi_incident as incident

config = pulumi.Config()
partner_webhook_token = config.require("partnerWebhookToken")
partner_webhook_token_secret = incident.Secret("partner_webhook_token",
    name="Partner webhook token",
    description="Bearer token for the partner's incident webhook",
    value_wo=partner_webhook_token,
    value_wo_version=1)
# The first way: put the secret's value inside a field's text.
#
# A field whose feature set ends in `_with_secrets` - which the webhook step's headers do -
# accepts a variable naming a secret by ID, and incident.io substitutes the value when the
# workflow runs. Write it as `{{ <secret id> }}` and reference the secret's `id`, never its
# value: Terraform is arranging for the value to be used, not handling it.
authorization_header = incident.get_rich_text_output(markdown=partner_webhook_token_secret.id.apply(lambda id: f"Authorization: Bearer {{{{ {id} }}}}"),
    feature_set="plain_single_line_with_secrets")
content_type_header = incident.get_rich_text(markdown="Content-Type: application/json",
    feature_set="plain_single_line_with_secrets")
webhook_endpoint = incident.get_rich_text(markdown="https://partner.example.com/hooks/incident",
    feature_set="plain_single_line")
webhook_body = incident.get_rich_text(markdown="{{ incident.name }} is now {{ incident.status }} at severity {{ incident.severity }}.\n",
    feature_set="rich")
notify_partner = incident.Workflow("notify_partner",
    name="Notify our partner of incident updates",
    trigger="incident.updated",
    expressions=[],
    condition_groups=[],
    steps=[{
        "id": "01K5TSNDBF7KBZY9AFDKYXJM3N",
        "name": "webhook.send",
        "param_bindings": [
            {
                "value_literal": webhook_endpoint.json,
            },
            {
                "value_literal": "POST",
            },
            {
                "values": [
                    authorization_header.json,
                    content_type_header.json,
                ],
            },
            {
                "value_literal": webhook_body.json,
            },
            {
                "value_literal": partner_webhook_token_secret.id,
            },
            {},
            {},
        ],
    }],
    once_fors=["incident"],
    private_incident_scope="none",
    continue_on_step_error=False,
    runs_on_incidents="newly_created_and_active",
    runs_on_incident_modes=["standard"],
    state="draft")

    package main

import (
	"fmt"

	"github.com/incident-io/pulumi-incident/sdk/go/incident"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		cfg := config.New(ctx, "")
		partnerWebhookToken := cfg.Require("partnerWebhookToken")
		partnerWebhookTokenSecret, err := incident.NewSecret(ctx, "partner_webhook_token", &incident.SecretArgs{
			Name:           pulumi.String("Partner webhook token"),
			Description:    pulumi.String("Bearer token for the partner's incident webhook"),
			ValueWo:        pulumi.String(partnerWebhookToken),
			ValueWoVersion: pulumi.Int(1),
		})
		if err != nil {
			return err
		}
		// The first way: put the secret's value inside a field's text.
		//
		// A field whose feature set ends in `_with_secrets` - which the webhook step's headers do -
		// accepts a variable naming a secret by ID, and incident.io substitutes the value when the
		// workflow runs. Write it as `{{ <secret id> }}` and reference the secret's `id`, never its
		// value: Terraform is arranging for the value to be used, not handling it.
		authorizationHeader := incident.GetRichTextOutput(ctx, incident.GetRichTextOutputArgs{
			Markdown: partnerWebhookTokenSecret.ID().ApplyT(func(id pulumi.ID) (string, error) {
				return fmt.Sprintf("Authorization: Bearer {{ %v }}", id), nil
			}).(pulumi.StringOutput),
			FeatureSet: pulumi.String("plain_single_line_with_secrets"),
		}, nil)
		contentTypeHeader, err := incident.GetRichText(ctx, &incident.GetRichTextArgs{
			Markdown:   "Content-Type: application/json",
			FeatureSet: "plain_single_line_with_secrets",
		}, nil)
		if err != nil {
			return err
		}
		webhookEndpoint, err := incident.GetRichText(ctx, &incident.GetRichTextArgs{
			Markdown:   "https://partner.example.com/hooks/incident",
			FeatureSet: "plain_single_line",
		}, nil)
		if err != nil {
			return err
		}
		webhookBody, err := incident.GetRichText(ctx, &incident.GetRichTextArgs{
			Markdown:   "{{ incident.name }} is now {{ incident.status }} at severity {{ incident.severity }}.\n",
			FeatureSet: "rich",
		}, nil)
		if err != nil {
			return err
		}
		_, err = incident.NewWorkflow(ctx, "notify_partner", &incident.WorkflowArgs{
			Name:            pulumi.String("Notify our partner of incident updates"),
			Trigger:         pulumi.String("incident.updated"),
			Expressions:     incident.WorkflowExpressionArray{},
			ConditionGroups: incident.WorkflowConditionGroupArray{},
			Steps: incident.WorkflowStepArray{
				&incident.WorkflowStepArgs{
					Id:   pulumi.String("01K5TSNDBF7KBZY9AFDKYXJM3N"),
					Name: pulumi.String("webhook.send"),
					ParamBindings: incident.WorkflowStepParamBindingArray{
						&incident.WorkflowStepParamBindingArgs{
							ValueLiteral: pulumi.String(webhookEndpoint.Json),
						},
						&incident.WorkflowStepParamBindingArgs{
							ValueLiteral: pulumi.String("POST"),
						},
						&incident.WorkflowStepParamBindingArgs{
							Values: pulumi.StringArray{
								authorizationHeader.Json(),
								pulumi.String(contentTypeHeader.Json),
							},
						},
						&incident.WorkflowStepParamBindingArgs{
							ValueLiteral: pulumi.String(webhookBody.Json),
						},
						&incident.WorkflowStepParamBindingArgs{
							ValueLiteral: partnerWebhookTokenSecret.ID().ToIDOutput().ToStringOutput(),
						},
						&incident.WorkflowStepParamBindingArgs{},
						&incident.WorkflowStepParamBindingArgs{},
					},
				},
			},
			OnceFors: pulumi.StringArray{
				pulumi.String("incident"),
			},
			PrivateIncidentScope: pulumi.String("none"),
			ContinueOnStepError:  pulumi.Bool(false),
			RunsOnIncidents:      pulumi.String("newly_created_and_active"),
			RunsOnIncidentModes: pulumi.StringArray{
				pulumi.String("standard"),
			},
			State: pulumi.String("draft"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Incident = Pulumi.Incident;

return await Deployment.RunAsync(() => 
{
    var config = new Config();
    var partnerWebhookToken = config.Require("partnerWebhookToken");
    var partnerWebhookTokenSecret = new Incident.Secret("partner_webhook_token", new()
    {
        Name = "Partner webhook token",
        Description = "Bearer token for the partner's incident webhook",
        ValueWo = partnerWebhookToken,
        ValueWoVersion = 1,
    });

    // The first way: put the secret's value inside a field's text.
    //
    // A field whose feature set ends in `_with_secrets` - which the webhook step's headers do -
    // accepts a variable naming a secret by ID, and incident.io substitutes the value when the
    // workflow runs. Write it as `{{ <secret id> }}` and reference the secret's `id`, never its
    // value: Terraform is arranging for the value to be used, not handling it.
    var authorizationHeader = Incident.GetRichText.Invoke(new()
    {
        Markdown = $"Authorization: Bearer {{{{ {partnerWebhookTokenSecret.Id} }}}}",
        FeatureSet = "plain_single_line_with_secrets",
    });

    var contentTypeHeader = Incident.GetRichText.Invoke(new()
    {
        Markdown = "Content-Type: application/json",
        FeatureSet = "plain_single_line_with_secrets",
    });

    var webhookEndpoint = Incident.GetRichText.Invoke(new()
    {
        Markdown = "https://partner.example.com/hooks/incident",
        FeatureSet = "plain_single_line",
    });

    var webhookBody = Incident.GetRichText.Invoke(new()
    {
        Markdown = @"{{ incident.name }} is now {{ incident.status }} at severity {{ incident.severity }}.
",
        FeatureSet = "rich",
    });

    var notifyPartner = new Incident.Workflow("notify_partner", new()
    {
        Name = "Notify our partner of incident updates",
        Trigger = "incident.updated",
        Expressions = new[] {},
        ConditionGroups = new[] {},
        Steps = new[]
        {
            new Incident.Inputs.WorkflowStepArgs
            {
                Id = "01K5TSNDBF7KBZY9AFDKYXJM3N",
                Name = "webhook.send",
                ParamBindings = new[]
                {
                    new Incident.Inputs.WorkflowStepParamBindingArgs
                    {
                        ValueLiteral = webhookEndpoint.Apply(getRichTextResult => getRichTextResult.Json),
                    },
                    new Incident.Inputs.WorkflowStepParamBindingArgs
                    {
                        ValueLiteral = "POST",
                    },
                    new Incident.Inputs.WorkflowStepParamBindingArgs
                    {
                        Values = new[]
                        {
                            authorizationHeader.Apply(getRichTextResult => getRichTextResult.Json),
                            contentTypeHeader.Apply(getRichTextResult => getRichTextResult.Json),
                        },
                    },
                    new Incident.Inputs.WorkflowStepParamBindingArgs
                    {
                        ValueLiteral = webhookBody.Apply(getRichTextResult => getRichTextResult.Json),
                    },
                    new Incident.Inputs.WorkflowStepParamBindingArgs
                    {
                        ValueLiteral = partnerWebhookTokenSecret.Id,
                    },
                    null,
                    null,
                },
            },
        },
        OnceFors = new[]
        {
            "incident",
        },
        PrivateIncidentScope = "none",
        ContinueOnStepError = false,
        RunsOnIncidents = "newly_created_and_active",
        RunsOnIncidentModes = new[]
        {
            "standard",
        },
        State = "draft",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.incident.Secret;
import com.pulumi.incident.SecretArgs;
import com.pulumi.incident.IncidentFunctions;
import com.pulumi.incident.inputs.GetRichTextArgs;
import com.pulumi.incident.Workflow;
import com.pulumi.incident.WorkflowArgs;
import com.pulumi.incident.inputs.WorkflowStepArgs;
import com.pulumi.incident.inputs.WorkflowStepParamBindingArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var config = ctx.config();
        final var partnerWebhookToken = config.require("partnerWebhookToken");
        var partnerWebhookTokenSecret = new Secret("partnerWebhookTokenSecret", SecretArgs.builder()
            .name("Partner webhook token")
            .description("Bearer token for the partner's incident webhook")
            .valueWo(partnerWebhookToken)
            .valueWoVersion(1)
            .build());

        // The first way: put the secret's value inside a field's text.
        //
        // A field whose feature set ends in `_with_secrets` - which the webhook step's headers do -
        // accepts a variable naming a secret by ID, and incident.io substitutes the value when the
        // workflow runs. Write it as `{{ <secret id> }}` and reference the secret's `id`, never its
        // value: Terraform is arranging for the value to be used, not handling it.
        final var authorizationHeader = IncidentFunctions.getRichText(GetRichTextArgs.builder()
            .markdown(partnerWebhookTokenSecret.id().applyValue(_id -> String.format("Authorization: Bearer {{{{ %s }}}}", _id)))
            .featureSet("plain_single_line_with_secrets")
            .build());

        final var contentTypeHeader = IncidentFunctions.getRichText(GetRichTextArgs.builder()
            .markdown("Content-Type: application/json")
            .featureSet("plain_single_line_with_secrets")
            .build());

        final var webhookEndpoint = IncidentFunctions.getRichText(GetRichTextArgs.builder()
            .markdown("https://partner.example.com/hooks/incident")
            .featureSet("plain_single_line")
            .build());

        final var webhookBody = IncidentFunctions.getRichText(GetRichTextArgs.builder()
            .markdown("""
{{ incident.name }} is now {{ incident.status }} at severity {{ incident.severity }}.
            """)
            .featureSet("rich")
            .build());

        var notifyPartner = new Workflow("notifyPartner", WorkflowArgs.builder()
            .name("Notify our partner of incident updates")
            .trigger("incident.updated")
            .expressions()
            .conditionGroups()
            .steps(WorkflowStepArgs.builder()
                .id("01K5TSNDBF7KBZY9AFDKYXJM3N")
                .name("webhook.send")
                .paramBindings(                
                    WorkflowStepParamBindingArgs.builder()
                        .valueLiteral(webhookEndpoint.json())
                        .build(),
                    WorkflowStepParamBindingArgs.builder()
                        .valueLiteral("POST")
                        .build(),
                    WorkflowStepParamBindingArgs.builder()
                        .values(                        
                            authorizationHeader.applyValue(_authorizationHeader -> _authorizationHeader.json()),
                            contentTypeHeader.json())
                        .build(),
                    WorkflowStepParamBindingArgs.builder()
                        .valueLiteral(webhookBody.json())
                        .build(),
                    WorkflowStepParamBindingArgs.builder()
                        .valueLiteral(partnerWebhookTokenSecret.id())
                        .build(),
                    WorkflowStepParamBindingArgs.builder()
                        .build(),
                    WorkflowStepParamBindingArgs.builder()
                        .build())
                .build())
            .onceFors("incident")
            .privateIncidentScope("none")
            .continueOnStepError(false)
            .runsOnIncidents("newly_created_and_active")
            .runsOnIncidentModes("standard")
            .state("draft")
            .build());

    }
}

    configuration:
  # A secret exists to be used, and a workflow's "Send a webhook" step is the main place
  # that happens. It can take a secret two different ways, and this workflow uses both.
  partnerWebhookToken:
    type: string
resources:
  partnerWebhookTokenSecret:
    type: incident:Secret
    name: partner_webhook_token
    properties:
      name: Partner webhook token
      description: Bearer token for the partner's incident webhook
      valueWo: ${partnerWebhookToken}
      valueWoVersion: 1
  notifyPartner:
    type: incident:Workflow
    name: notify_partner
    properties:
      name: Notify our partner of incident updates
      trigger: incident.updated
      expressions: []
      conditionGroups: []
      steps:
        - id: 01K5TSNDBF7KBZY9AFDKYXJM3N
          name: webhook.send
          paramBindings:
            - valueLiteral: ${webhookEndpoint.json}
            - valueLiteral: POST
            - values:
                - ${authorizationHeader.json}
                - ${contentTypeHeader.json}
            - valueLiteral: ${webhookBody.json}
            - valueLiteral: ${partnerWebhookTokenSecret.id}
            - {}
            - {}
      onceFors:
        - incident
      privateIncidentScope: none
      continueOnStepError: false
      runsOnIncidents: newly_created_and_active
      runsOnIncidentModes:
        - standard
      state: draft
variables:
  # The first way: put the secret's value inside a field's text.
  #
  # A field whose feature set ends in `_with_secrets` - which the webhook step's headers do -
  # accepts a variable naming a secret by ID, and incident.io substitutes the value when the
  # workflow runs. Write it as `{{ <secret id> }}` and reference the secret's `id`, never its
  # value: Terraform is arranging for the value to be used, not handling it.
  authorizationHeader:
    fn::invoke:
      function: incident:getRichText
      arguments:
        markdown: 'Authorization: Bearer {{ ${partnerWebhookTokenSecret.id} }}'
        featureSet: plain_single_line_with_secrets
  contentTypeHeader:
    fn::invoke:
      function: incident:getRichText
      arguments:
        markdown: 'Content-Type: application/json'
        featureSet: plain_single_line_with_secrets
  webhookEndpoint:
    fn::invoke:
      function: incident:getRichText
      arguments:
        markdown: https://partner.example.com/hooks/incident
        featureSet: plain_single_line
  webhookBody:
    fn::invoke:
      function: incident:getRichText
      arguments:
        markdown: |
          {{ incident.name }} is now {{ incident.status }} at severity {{ incident.severity }}.
        featureSet: rich

    pulumi {
  required_providers {
    incident = {
      source = "pulumi/incident"
    }
  }
}

data "incident_getrichtext" "authorizationHeader" {
  markdown    ="Authorization: Bearer {{ ${incident_secret.partner_webhook_token.id} }}"
  feature_set = "plain_single_line_with_secrets"
}
data "incident_getrichtext" "contentTypeHeader" {
  markdown    = "Content-Type: application/json"
  feature_set = "plain_single_line_with_secrets"
}
data "incident_getrichtext" "webhookEndpoint" {
  markdown    = "https://partner.example.com/hooks/incident"
  feature_set = "plain_single_line"
}
data "incident_getrichtext" "webhookBody" {
  markdown    = "{{ incident.name }} is now {{ incident.status }} at severity {{ incident.severity }}.\n"
  feature_set = "rich"
}

resource "incident_secret" "partner_webhook_token" {
  name             = "Partner webhook token"
  description      = "Bearer token for the partner's incident webhook"
  value_wo         = var.partnerWebhookToken
  value_wo_version = 1
}
resource "incident_workflow" "notify_partner" {
  name    = "Notify our partner of incident updates"
  trigger = "incident.updated"
  steps {
    id   = "01K5TSNDBF7KBZY9AFDKYXJM3N"
    name = "webhook.send"
    param_bindings {
      value_literal = data.incident_getrichtext.webhookEndpoint.json
    }
    param_bindings {
      value_literal = "POST"
    }
    param_bindings {
      values = [data.incident_getrichtext.authorizationHeader.json, data.incident_getrichtext.contentTypeHeader.json]
    }
    param_bindings {
      value_literal = data.incident_getrichtext.webhookBody.json
    }
    param_bindings {
      value_literal = incident_secret.partner_webhook_token.id
    }
    param_bindings {
    }
    param_bindings {
    }
  }
  once_fors              = ["incident"]
  private_incident_scope = "none"
  continue_on_step_error = false
  runs_on_incidents      = "newly_created_and_active"
  runs_on_incident_modes = ["standard"]
  state                  = "draft"
}
# A secret exists to be used, and a workflow's "Send a webhook" step is the main place
# that happens. It can take a secret two different ways, and this workflow uses both.
variable "partnerWebhookToken" {
  type = string
}
# The first way: put the secret's value inside a field's text.
#
# A field whose feature set ends in `_with_secrets` - which the webhook step's headers do -
# accepts a variable naming a secret by ID, and incident.io substitutes the value when the
# workflow runs. Write it as `{{ <secret id> }}` and reference the secret's `id`, never its
# value: Terraform is arranging for the value to be used, not handling it.

    Create Secret Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Secret(name: string, args?: SecretArgs, opts?: CustomResourceOptions);
    @overload
def Secret(resource_name: str,
           args: Optional[SecretArgs] = None,
           opts: Optional[ResourceOptions] = None)

@overload
def Secret(resource_name: str,
           opts: Optional[ResourceOptions] = None,
           description: Optional[str] = None,
           name: Optional[str] = None,
           owning_team_ids: Optional[Sequence[str]] = None,
           unlock_in_dashboard: Optional[bool] = None,
           value_wo: Optional[str] = None,
           value_wo_version: Optional[int] = None)
    func NewSecret(ctx *Context, name string, args *SecretArgs, opts ...ResourceOption) (*Secret, error)
    public Secret(string name, SecretArgs? args = null, CustomResourceOptions? opts = null)
    public Secret(String name, SecretArgs args)
public Secret(String name, SecretArgs args, CustomResourceOptions options)

    type: incident:Secret
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "incident_secret" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args SecretArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecretArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecretArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecretArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecretArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var secretResource = new Incident.Secret("secretResource", new()
{
    Description = "string",
    Name = "string",
    OwningTeamIds = new[]
    {
        "string",
    },
    UnlockInDashboard = false,
    ValueWo = "string",
    ValueWoVersion = 0,
});

    example, err := incident.NewSecret(ctx, "secretResource", &incident.SecretArgs{
	Description: pulumi.String("string"),
	Name:        pulumi.String("string"),
	OwningTeamIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	UnlockInDashboard: pulumi.Bool(false),
	ValueWo:           pulumi.String("string"),
	ValueWoVersion:    pulumi.Int(0),
})

    resource "incident_secret" "secretResource" {
  lifecycle {
    create_before_destroy = true
  }
  description         = "string"
  name                = "string"
  owning_team_ids     = ["string"]
  unlock_in_dashboard = false
  value_wo            = "string"
  value_wo_version    = 0
}

    var secretResource = new Secret("secretResource", SecretArgs.builder()
    .description("string")
    .name("string")
    .owningTeamIds("string")
    .unlockInDashboard(false)
    .valueWo("string")
    .valueWoVersion(0)
    .build());

    secret_resource = incident.Secret("secretResource",
    description="string",
    name="string",
    owning_team_ids=["string"],
    unlock_in_dashboard=False,
    value_wo="string",
    value_wo_version=0)

    const secretResource = new incident.Secret("secretResource", {
    description: "string",
    name: "string",
    owningTeamIds: ["string"],
    unlockInDashboard: false,
    valueWo: "string",
    valueWoVersion: 0,
});

    type: incident:Secret
properties:
    description: string
    name: string
    owningTeamIds:
        - string
    unlockInDashboard: false
    valueWo: string
    valueWoVersion: 0

    Secret Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Secret resource accepts the following input properties:

    Description string
    Optional description of what this secret is for
    Name string
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    OwningTeamIds List<string>
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    UnlockInDashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    ValueWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    ValueWoVersion int
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    Description string
    Optional description of what this secret is for
    Name string
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    OwningTeamIds []string
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    UnlockInDashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    ValueWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    ValueWoVersion int
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    description string
    Optional description of what this secret is for
    name string
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    owning_team_ids list(string)
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    unlock_in_dashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    value_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    value_wo_version number
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    description String
    Optional description of what this secret is for
    name String
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    owningTeamIds List<String>
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    unlockInDashboard Boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    valueWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    valueWoVersion Integer
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    description string
    Optional description of what this secret is for
    name string
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    owningTeamIds string[]
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    unlockInDashboard boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    valueWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    valueWoVersion number
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    description str
    Optional description of what this secret is for
    name str
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    owning_team_ids Sequence[str]
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    unlock_in_dashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    value_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    value_wo_version int
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    description String
    Optional description of what this secret is for
    name String
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    owningTeamIds List<String>
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    unlockInDashboard Boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    valueWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    valueWoVersion Number
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Secret resource produces the following output properties:

    CreatedAt string
    When this secret was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastFourChars string
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    UpdatedAt string
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    Version int
    The current version number, incremented on each rotation
    CreatedAt string
    When this secret was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastFourChars string
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    UpdatedAt string
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    Version int
    The current version number, incremented on each rotation
    created_at string
    When this secret was created.
    id string
    The provider-assigned unique ID for this managed resource.
    last_four_chars string
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    updated_at string
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    version number
    The current version number, incremented on each rotation
    createdAt String
    When this secret was created.
    id String
    The provider-assigned unique ID for this managed resource.
    lastFourChars String
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    updatedAt String
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    version Integer
    The current version number, incremented on each rotation
    createdAt string
    When this secret was created.
    id string
    The provider-assigned unique ID for this managed resource.
    lastFourChars string
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    updatedAt string
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    version number
    The current version number, incremented on each rotation
    created_at str
    When this secret was created.
    id str
    The provider-assigned unique ID for this managed resource.
    last_four_chars str
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    updated_at str
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    version int
    The current version number, incremented on each rotation
    createdAt String
    When this secret was created.
    id String
    The provider-assigned unique ID for this managed resource.
    lastFourChars String
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    updatedAt String
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    version Number
    The current version number, incremented on each rotation

    Look up Existing Secret Resource

    Get an existing Secret resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecretState, opts?: CustomResourceOptions): Secret
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        created_at: Optional[str] = None,
        description: Optional[str] = None,
        last_four_chars: Optional[str] = None,
        name: Optional[str] = None,
        owning_team_ids: Optional[Sequence[str]] = None,
        unlock_in_dashboard: Optional[bool] = None,
        updated_at: Optional[str] = None,
        value_wo: Optional[str] = None,
        value_wo_version: Optional[int] = None,
        version: Optional[int] = None) -> Secret
    func GetSecret(ctx *Context, name string, id IDInput, state *SecretState, opts ...ResourceOption) (*Secret, error)
    public static Secret Get(string name, Input<string> id, SecretState? state, CustomResourceOptions? opts = null)
    public static Secret get(String name, Output<String> id, SecretState state, CustomResourceOptions options)
    resources:  _:    type: incident:Secret    get:      id: ${id}
    import {
  to = incident_secret.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CreatedAt string
    When this secret was created.
    Description string
    Optional description of what this secret is for
    LastFourChars string
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    Name string
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    OwningTeamIds List<string>
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    UnlockInDashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    UpdatedAt string
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    ValueWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    ValueWoVersion int
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    Version int
    The current version number, incremented on each rotation
    CreatedAt string
    When this secret was created.
    Description string
    Optional description of what this secret is for
    LastFourChars string
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    Name string
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    OwningTeamIds []string
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    UnlockInDashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    UpdatedAt string
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    ValueWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    ValueWoVersion int
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    Version int
    The current version number, incremented on each rotation
    created_at string
    When this secret was created.
    description string
    Optional description of what this secret is for
    last_four_chars string
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    name string
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    owning_team_ids list(string)
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    unlock_in_dashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    updated_at string
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    value_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    value_wo_version number
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    version number
    The current version number, incremented on each rotation
    createdAt String
    When this secret was created.
    description String
    Optional description of what this secret is for
    lastFourChars String
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    name String
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    owningTeamIds List<String>
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    unlockInDashboard Boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    updatedAt String
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    valueWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    valueWoVersion Integer
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    version Integer
    The current version number, incremented on each rotation
    createdAt string
    When this secret was created.
    description string
    Optional description of what this secret is for
    lastFourChars string
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    name string
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    owningTeamIds string[]
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    unlockInDashboard boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    updatedAt string
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    valueWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    valueWoVersion number
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    version number
    The current version number, incremented on each rotation
    created_at str
    When this secret was created.
    description str
    Optional description of what this secret is for
    last_four_chars str
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    name str
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    owning_team_ids Sequence[str]
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    unlock_in_dashboard bool
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    updated_at str
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    value_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    value_wo_version int
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    version int
    The current version number, incremented on each rotation
    createdAt String
    When this secret was created.
    description String
    Optional description of what this secret is for
    lastFourChars String
    The last four characters of the current value, for masked display. Absent when the value is four characters or shorter.
    name String
    Human-readable name, unique within the organisation amongst unarchived secrets. At most 1024 bytes, counted in bytes rather than characters, so a name using multi-byte characters reaches the limit sooner.
    owningTeamIds List<String>
    IDs of the teams that own this secret. Empty means the secret is owned by the whole organisation.
    unlockInDashboard Boolean
    Whether to leave this resource unlocked in the incident.io dashboard, so people can edit it there. Defaults to false: Terraform claims what it manages, and a claimed resource cannot be edited in the dashboard. Set it to true to leave the resource unclaimed — pair that with lifecycle { ignoreChanges = [...] } naming the attributes people edit, or the next apply reverts them. Setting it on a resource Terraform already claimed hands that resource back, and someone disconnecting one in the dashboard shows as no change.
    updatedAt String
    When this secret was last changed, which includes being rotated as well as having its metadata edited.
    valueWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. The secret's plaintext value, as a write-only attribute: it is sent to incident.io and never written to state or to a plan file. Required when creating a secret. Changing it alone has no effect, as Terraform cannot see that it changed: change valueWoVersion to rotate the secret.
    valueWoVersion Number
    The version of valueWo this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the secret to the current valueWo. It is your own counter, unrelated to the version incident.io reports.
    version Number
    The current version number, incremented on each rotation

    Import

    Import is supported using an import block or the pulumi import command:

    The pulumi import command can be used, for example:

    !/bin/bash

    Import a secret using its ID Replace the ID with a real ID from your incident.io organization

    $ pulumi import incident:index/secret:Secret example 01ABC123DEF456GHI789JKL

    An imported secret has no value_wo_version, because the value it already holds didn’t come from your configuration. If your config sets valueWo and value_wo_version, the first apply after importing will rotate the secret to that value - the plan says so. To adopt a secret without touching its value, leave both attributes unset.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    incident incident-io/pulumi-incident
    License
    MIT
    Notes
    This Pulumi package is based on the incident Terraform Provider.
    incident logo incident.io
    Viewing docs for incident.io v0.4.0
    published on Saturday, Oct 17, 2026 by incident-io
    Schema (JSON)
    incident-io/pulumi-incident

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial