Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Keycloak Provider
  4. API Docs
  5. Workflow
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

keycloak.Workflow

keycloak logo keycloak logo
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

    Allows creating and managing workflows within Keycloak.

    Workflows automate administrative tasks in response to realm events (e.g. onboarding new users, sending notifications). This feature requires Keycloak 26.4 or later and must be enabled with --features=workflows at startup.

    Example Usage

    Onboard new users

    This example mirrors the official Keycloak workflow guide. The example workflow sends the user a welcome notification, then requires them to update their password after 30 days. Finally, it restarts the workflow so the password update requirement repeats every 30 days.

    The workflow triggers on every userCreated event.

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    enabled: true,
});
const onboarding = new keycloak.Workflow("onboarding", {
    realm: realm.id,
    name: "onboarding-new-users",
    on: "user_created",
    enabled: true,
    steps: [
        {
            uses: "notify-user",
            config: {
                message: `<p>Dear \${user.firstName} \${user.lastName}, </p>
<p>Welcome to \${realm.displayName}!</p>
<p>
   Best regards,<br/>
   The Keycloak Team
</p>
`,
            },
        },
        {
            uses: "set-user-required-action",
            after: "2592000000",
            config: {
                action: "UPDATE_PASSWORD",
            },
        },
        {
            uses: "restart",
            config: {
                position: "1",
            },
        },
    ],
});

    import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    realm="my-realm",
    enabled=True)
onboarding = keycloak.Workflow("onboarding",
    realm=realm.id,
    name="onboarding-new-users",
    on="user_created",
    enabled=True,
    steps=[
        {
            "uses": "notify-user",
            "config": {
                "message": """<p>Dear ${user.firstName} ${user.lastName}, </p>
<p>Welcome to ${realm.displayName}!</p>
<p>
   Best regards,<br/>
   The Keycloak Team
</p>
""",
            },
        },
        {
            "uses": "set-user-required-action",
            "after": "2592000000",
            "config": {
                "action": "UPDATE_PASSWORD",
            },
        },
        {
            "uses": "restart",
            "config": {
                "position": "1",
            },
        },
    ])

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:   pulumi.String("my-realm"),
			Enabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		_, err = keycloak.NewWorkflow(ctx, "onboarding", &keycloak.WorkflowArgs{
			Realm:   realm.ID(),
			Name:    pulumi.String("onboarding-new-users"),
			On:      pulumi.String("user_created"),
			Enabled: pulumi.Bool(true),
			Steps: keycloak.WorkflowStepArray{
				&keycloak.WorkflowStepArgs{
					Uses: pulumi.String("notify-user"),
					Config: pulumi.StringMap{
						"message": pulumi.String(`<p>Dear ${user.firstName} ${user.lastName}, </p>
<p>Welcome to ${realm.displayName}!</p>
<p>
   Best regards,<br/>
   The Keycloak Team
</p>
`),
					},
				},
				&keycloak.WorkflowStepArgs{
					Uses:  pulumi.String("set-user-required-action"),
					After: pulumi.String("2592000000"),
					Config: pulumi.StringMap{
						"action": pulumi.String("UPDATE_PASSWORD"),
					},
				},
				&keycloak.WorkflowStepArgs{
					Uses: pulumi.String("restart"),
					Config: pulumi.StringMap{
						"position": pulumi.String("1"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        Enabled = true,
    });

    var onboarding = new Keycloak.Workflow("onboarding", new()
    {
        Realm = realm.Id,
        Name = "onboarding-new-users",
        On = "user_created",
        Enabled = true,
        Steps = new[]
        {
            new Keycloak.Inputs.WorkflowStepArgs
            {
                Uses = "notify-user",
                Config = 
                {
                    { "message", @"<p>Dear ${user.firstName} ${user.lastName}, </p>
<p>Welcome to ${realm.displayName}!</p>
<p>
   Best regards,<br/>
   The Keycloak Team
</p>
" },
                },
            },
            new Keycloak.Inputs.WorkflowStepArgs
            {
                Uses = "set-user-required-action",
                After = "2592000000",
                Config = 
                {
                    { "action", "UPDATE_PASSWORD" },
                },
            },
            new Keycloak.Inputs.WorkflowStepArgs
            {
                Uses = "restart",
                Config = 
                {
                    { "position", "1" },
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.Workflow;
import com.pulumi.keycloak.WorkflowArgs;
import com.pulumi.keycloak.inputs.WorkflowStepArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .enabled(true)
            .build());

        var onboarding = new Workflow("onboarding", WorkflowArgs.builder()
            .realm(realm.id())
            .name("onboarding-new-users")
            .on("user_created")
            .enabled(true)
            .steps(            
                WorkflowStepArgs.builder()
                    .uses("notify-user")
                    .config(Map.of("message", """
<p>Dear ${user.firstName} ${user.lastName}, </p>
<p>Welcome to ${realm.displayName}!</p>
<p>
   Best regards,<br/>
   The Keycloak Team
</p>
                    """))
                    .build(),
                WorkflowStepArgs.builder()
                    .uses("set-user-required-action")
                    .after("2592000000")
                    .config(Map.of("action", "UPDATE_PASSWORD"))
                    .build(),
                WorkflowStepArgs.builder()
                    .uses("restart")
                    .config(Map.of("position", "1"))
                    .build())
            .build());

    }
}

    resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      enabled: true
  onboarding:
    type: keycloak:Workflow
    properties:
      realm: ${realm.id}
      name: onboarding-new-users
      on: user_created
      enabled: true
      steps:
        - uses: notify-user
          config:
            message: |
              <p>Dear $${user.firstName} $${user.lastName}, </p>
              <p>Welcome to $${realm.displayName}!</p>
              <p>
                 Best regards,<br/>
                 The Keycloak Team
              </p>
        - uses: set-user-required-action
          after: '2592000000'
          config:
            action: UPDATE_PASSWORD
        - uses: restart
          config:
            position: '1'

    pulumi {
  required_providers {
    keycloak = {
      source = "pulumi/keycloak"
    }
  }
}

resource "keycloak_realm" "realm" {
  realm   = "my-realm"
  enabled = true
}
resource "keycloak_workflow" "onboarding" {
  realm   = keycloak_realm.realm.id
  name    = "onboarding-new-users"
  on      = "user_created"
  enabled = true
  steps {
    uses = "notify-user"
    config = {
      "message" = "<p>Dear $${user.firstName} $${user.lastName}, </p>\n<p>Welcome to $${realm.displayName}!</p>\n<p>\n   Best regards,<br/>\n   The Keycloak Team\n</p>\n"
    }
  }
  steps {
    uses  = "set-user-required-action"
    after = "2592000000"
    config = {
      "action" = "UPDATE_PASSWORD"
    }
  }
  steps {
    uses = "restart"
    config = {
      "position" = "1"
    }
  }
}

    Notify then delete a user after account creation

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const offboard = new keycloak.Workflow("offboard", {
    realm: realm.id,
    name: "offboard-users",
    on: "user_created",
    enabled: true,
    steps: [
        {
            uses: "notify-user",
            after: "2505600000",
            config: {
                emailTemplate: "offboarding-warning",
            },
        },
        {
            uses: "delete-user",
            after: "2592000000",
        },
    ],
});

    import pulumi
import pulumi_keycloak as keycloak

offboard = keycloak.Workflow("offboard",
    realm=realm["id"],
    name="offboard-users",
    on="user_created",
    enabled=True,
    steps=[
        {
            "uses": "notify-user",
            "after": "2505600000",
            "config": {
                "emailTemplate": "offboarding-warning",
            },
        },
        {
            "uses": "delete-user",
            "after": "2592000000",
        },
    ])

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keycloak.NewWorkflow(ctx, "offboard", &keycloak.WorkflowArgs{
			Realm:   pulumi.Any(realm.Id),
			Name:    pulumi.String("offboard-users"),
			On:      pulumi.String("user_created"),
			Enabled: pulumi.Bool(true),
			Steps: keycloak.WorkflowStepArray{
				&keycloak.WorkflowStepArgs{
					Uses:  pulumi.String("notify-user"),
					After: pulumi.String("2505600000"),
					Config: pulumi.StringMap{
						"emailTemplate": pulumi.String("offboarding-warning"),
					},
				},
				&keycloak.WorkflowStepArgs{
					Uses:  pulumi.String("delete-user"),
					After: pulumi.String("2592000000"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var offboard = new Keycloak.Workflow("offboard", new()
    {
        Realm = realm.Id,
        Name = "offboard-users",
        On = "user_created",
        Enabled = true,
        Steps = new[]
        {
            new Keycloak.Inputs.WorkflowStepArgs
            {
                Uses = "notify-user",
                After = "2505600000",
                Config = 
                {
                    { "emailTemplate", "offboarding-warning" },
                },
            },
            new Keycloak.Inputs.WorkflowStepArgs
            {
                Uses = "delete-user",
                After = "2592000000",
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Workflow;
import com.pulumi.keycloak.WorkflowArgs;
import com.pulumi.keycloak.inputs.WorkflowStepArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var offboard = new Workflow("offboard", WorkflowArgs.builder()
            .realm(realm.id())
            .name("offboard-users")
            .on("user_created")
            .enabled(true)
            .steps(            
                WorkflowStepArgs.builder()
                    .uses("notify-user")
                    .after("2505600000")
                    .config(Map.of("emailTemplate", "offboarding-warning"))
                    .build(),
                WorkflowStepArgs.builder()
                    .uses("delete-user")
                    .after("2592000000")
                    .build())
            .build());

    }
}

    resources:
  offboard:
    type: keycloak:Workflow
    properties:
      realm: ${realm.id}
      name: offboard-users
      on: user_created
      enabled: true
      steps:
        - uses: notify-user
          after: '2505600000'
          config:
            emailTemplate: offboarding-warning
        - uses: delete-user
          after: '2592000000'

    pulumi {
  required_providers {
    keycloak = {
      source = "pulumi/keycloak"
    }
  }
}

resource "keycloak_workflow" "offboard" {
  realm   = realm.id
  name    = "offboard-users"
  on      = "user_created"
  enabled = true
  steps {
    uses  = "notify-user"
    after = "2505600000"
    config = {
      "emailTemplate" = "offboarding-warning"
    }
  }
  steps {
    uses  = "delete-user"
    after = "2592000000"
  }
}

    Onboard gold members only

    This mirrors the common use cases guide. The conditions expression restricts the workflow to users that have the membership=gold attribute, then sends a welcome message and grants the gold-member role.

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const onboardGoldMembers = new keycloak.Workflow("onboard_gold_members", {
    realm: realm.id,
    name: "onboarding-gold-members",
    on: "user_created",
    enabled: true,
    conditions: "has-user-attribute(membership=gold)",
    steps: [
        {
            uses: "notify-user",
            config: {
                message: "Welcome to the Gold Membership program!",
            },
        },
        {
            uses: "grant-role",
            config: {
                role: "gold-member",
            },
        },
    ],
});

    import pulumi
import pulumi_keycloak as keycloak

onboard_gold_members = keycloak.Workflow("onboard_gold_members",
    realm=realm["id"],
    name="onboarding-gold-members",
    on="user_created",
    enabled=True,
    conditions="has-user-attribute(membership=gold)",
    steps=[
        {
            "uses": "notify-user",
            "config": {
                "message": "Welcome to the Gold Membership program!",
            },
        },
        {
            "uses": "grant-role",
            "config": {
                "role": "gold-member",
            },
        },
    ])

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keycloak.NewWorkflow(ctx, "onboard_gold_members", &keycloak.WorkflowArgs{
			Realm:      pulumi.Any(realm.Id),
			Name:       pulumi.String("onboarding-gold-members"),
			On:         pulumi.String("user_created"),
			Enabled:    pulumi.Bool(true),
			Conditions: pulumi.String("has-user-attribute(membership=gold)"),
			Steps: keycloak.WorkflowStepArray{
				&keycloak.WorkflowStepArgs{
					Uses: pulumi.String("notify-user"),
					Config: pulumi.StringMap{
						"message": pulumi.String("Welcome to the Gold Membership program!"),
					},
				},
				&keycloak.WorkflowStepArgs{
					Uses: pulumi.String("grant-role"),
					Config: pulumi.StringMap{
						"role": pulumi.String("gold-member"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var onboardGoldMembers = new Keycloak.Workflow("onboard_gold_members", new()
    {
        Realm = realm.Id,
        Name = "onboarding-gold-members",
        On = "user_created",
        Enabled = true,
        Conditions = "has-user-attribute(membership=gold)",
        Steps = new[]
        {
            new Keycloak.Inputs.WorkflowStepArgs
            {
                Uses = "notify-user",
                Config = 
                {
                    { "message", "Welcome to the Gold Membership program!" },
                },
            },
            new Keycloak.Inputs.WorkflowStepArgs
            {
                Uses = "grant-role",
                Config = 
                {
                    { "role", "gold-member" },
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Workflow;
import com.pulumi.keycloak.WorkflowArgs;
import com.pulumi.keycloak.inputs.WorkflowStepArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var onboardGoldMembers = new Workflow("onboardGoldMembers", WorkflowArgs.builder()
            .realm(realm.id())
            .name("onboarding-gold-members")
            .on("user_created")
            .enabled(true)
            .conditions("has-user-attribute(membership=gold)")
            .steps(            
                WorkflowStepArgs.builder()
                    .uses("notify-user")
                    .config(Map.of("message", "Welcome to the Gold Membership program!"))
                    .build(),
                WorkflowStepArgs.builder()
                    .uses("grant-role")
                    .config(Map.of("role", "gold-member"))
                    .build())
            .build());

    }
}

    resources:
  onboardGoldMembers:
    type: keycloak:Workflow
    name: onboard_gold_members
    properties:
      realm: ${realm.id}
      name: onboarding-gold-members
      on: user_created
      enabled: true
      conditions: has-user-attribute(membership=gold)
      steps:
        - uses: notify-user
          config:
            message: Welcome to the Gold Membership program!
        - uses: grant-role
          config:
            role: gold-member

    pulumi {
  required_providers {
    keycloak = {
      source = "pulumi/keycloak"
    }
  }
}

resource "keycloak_workflow" "onboard_gold_members" {
  realm      = realm.id
  name       = "onboarding-gold-members"
  on         = "user_created"
  enabled    = true
  conditions = "has-user-attribute(membership=gold)"
  steps {
    uses = "notify-user"
    config = {
      "message" = "Welcome to the Gold Membership program!"
    }
  }
  steps {
    uses = "grant-role"
    config = {
      "role" = "gold-member"
    }
  }
}

    Track inactive users on a schedule

    This example mirrors the scheduling workflows guide. Instead of reacting to a single event, the workflow engine periodically scans realm resources (here, every 30s, up to 100 users per run) and progresses each matching user through the steps. restartInProgress restarts an in-progress execution when the user authenticates again, so the inactivity countdown resets.

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const trackInactiveUsers = new keycloak.Workflow("track_inactive_users", {
    realm: realm.id,
    name: "track-inactive-users",
    on: "user_authenticated",
    enabled: true,
    restartInProgress: "true",
    schedule: {
        after: "30s",
        batchSize: 100,
    },
    steps: [
        {
            uses: "notify-user",
            after: "180d",
            config: {
                message: "It has been a while since your last login. We miss you!",
            },
        },
        {
            uses: "notify-user",
            after: "60d",
            config: {
                message: "Your account will be disabled in ${workflow.daysUntilNextStep} days!",
            },
        },
        {
            uses: "disable-user",
            after: "7d",
        },
    ],
});

    import pulumi
import pulumi_keycloak as keycloak

track_inactive_users = keycloak.Workflow("track_inactive_users",
    realm=realm["id"],
    name="track-inactive-users",
    on="user_authenticated",
    enabled=True,
    restart_in_progress="true",
    schedule={
        "after": "30s",
        "batch_size": 100,
    },
    steps=[
        {
            "uses": "notify-user",
            "after": "180d",
            "config": {
                "message": "It has been a while since your last login. We miss you!",
            },
        },
        {
            "uses": "notify-user",
            "after": "60d",
            "config": {
                "message": "Your account will be disabled in ${workflow.daysUntilNextStep} days!",
            },
        },
        {
            "uses": "disable-user",
            "after": "7d",
        },
    ])

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keycloak.NewWorkflow(ctx, "track_inactive_users", &keycloak.WorkflowArgs{
			Realm:             pulumi.Any(realm.Id),
			Name:              pulumi.String("track-inactive-users"),
			On:                pulumi.String("user_authenticated"),
			Enabled:           pulumi.Bool(true),
			RestartInProgress: pulumi.String("true"),
			Schedule: &keycloak.WorkflowScheduleArgs{
				After:     pulumi.String("30s"),
				BatchSize: pulumi.Int(100),
			},
			Steps: keycloak.WorkflowStepArray{
				&keycloak.WorkflowStepArgs{
					Uses:  pulumi.String("notify-user"),
					After: pulumi.String("180d"),
					Config: pulumi.StringMap{
						"message": pulumi.String("It has been a while since your last login. We miss you!"),
					},
				},
				&keycloak.WorkflowStepArgs{
					Uses:  pulumi.String("notify-user"),
					After: pulumi.String("60d"),
					Config: pulumi.StringMap{
						"message": pulumi.String("Your account will be disabled in ${workflow.daysUntilNextStep} days!"),
					},
				},
				&keycloak.WorkflowStepArgs{
					Uses:  pulumi.String("disable-user"),
					After: pulumi.String("7d"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var trackInactiveUsers = new Keycloak.Workflow("track_inactive_users", new()
    {
        Realm = realm.Id,
        Name = "track-inactive-users",
        On = "user_authenticated",
        Enabled = true,
        RestartInProgress = "true",
        Schedule = new Keycloak.Inputs.WorkflowScheduleArgs
        {
            After = "30s",
            BatchSize = 100,
        },
        Steps = new[]
        {
            new Keycloak.Inputs.WorkflowStepArgs
            {
                Uses = "notify-user",
                After = "180d",
                Config = 
                {
                    { "message", "It has been a while since your last login. We miss you!" },
                },
            },
            new Keycloak.Inputs.WorkflowStepArgs
            {
                Uses = "notify-user",
                After = "60d",
                Config = 
                {
                    { "message", "Your account will be disabled in ${workflow.daysUntilNextStep} days!" },
                },
            },
            new Keycloak.Inputs.WorkflowStepArgs
            {
                Uses = "disable-user",
                After = "7d",
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Workflow;
import com.pulumi.keycloak.WorkflowArgs;
import com.pulumi.keycloak.inputs.WorkflowScheduleArgs;
import com.pulumi.keycloak.inputs.WorkflowStepArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var trackInactiveUsers = new Workflow("trackInactiveUsers", WorkflowArgs.builder()
            .realm(realm.id())
            .name("track-inactive-users")
            .on("user_authenticated")
            .enabled(true)
            .restartInProgress("true")
            .schedule(WorkflowScheduleArgs.builder()
                .after("30s")
                .batchSize(100)
                .build())
            .steps(            
                WorkflowStepArgs.builder()
                    .uses("notify-user")
                    .after("180d")
                    .config(Map.of("message", "It has been a while since your last login. We miss you!"))
                    .build(),
                WorkflowStepArgs.builder()
                    .uses("notify-user")
                    .after("60d")
                    .config(Map.of("message", "Your account will be disabled in ${workflow.daysUntilNextStep} days!"))
                    .build(),
                WorkflowStepArgs.builder()
                    .uses("disable-user")
                    .after("7d")
                    .build())
            .build());

    }
}

    resources:
  trackInactiveUsers:
    type: keycloak:Workflow
    name: track_inactive_users
    properties:
      realm: ${realm.id}
      name: track-inactive-users
      on: user_authenticated
      enabled: true
      restartInProgress: 'true'
      schedule:
        after: 30s
        batchSize: 100
      steps:
        - uses: notify-user
          after: 180d
          config:
            message: It has been a while since your last login. We miss you!
        - uses: notify-user
          after: 60d
          config:
            message: Your account will be disabled in $${workflow.daysUntilNextStep} days!
        - uses: disable-user
          after: 7d

    pulumi {
  required_providers {
    keycloak = {
      source = "pulumi/keycloak"
    }
  }
}

resource "keycloak_workflow" "track_inactive_users" {
  realm               = realm.id
  name                = "track-inactive-users"
  on                  = "user_authenticated"
  enabled             = true
  restart_in_progress = "true"
  schedule = {
    after      = "30s"
    batch_size = 100
  }
  steps {
    uses  = "notify-user"
    after = "180d"
    config = {
      "message" = "It has been a while since your last login. We miss you!"
    }
  }
  steps {
    uses  = "notify-user"
    after = "60d"
    config = {
      "message" = "Your account will be disabled in $${workflow.daysUntilNextStep} days!"
    }
  }
  steps {
    uses  = "disable-user"
    after = "7d"
  }
}

    Create Workflow Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Workflow(name: string, args: WorkflowArgs, opts?: CustomResourceOptions);
    @overload
def Workflow(resource_name: str,
             args: WorkflowArgs,
             opts: Optional[ResourceOptions] = None)

@overload
def Workflow(resource_name: str,
             opts: Optional[ResourceOptions] = None,
             on: Optional[str] = None,
             realm: Optional[str] = None,
             steps: Optional[Sequence[WorkflowStepArgs]] = None,
             cancel_in_progress: Optional[str] = None,
             conditions: Optional[str] = None,
             enabled: Optional[bool] = None,
             name: Optional[str] = None,
             restart_in_progress: Optional[str] = None,
             schedule: Optional[WorkflowScheduleArgs] = None)
    func NewWorkflow(ctx *Context, name string, args WorkflowArgs, opts ...ResourceOption) (*Workflow, error)
    public Workflow(string name, WorkflowArgs args, CustomResourceOptions? opts = null)
    public Workflow(String name, WorkflowArgs args)
public Workflow(String name, WorkflowArgs args, CustomResourceOptions options)

    type: keycloak:Workflow
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "keycloak_workflow" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args WorkflowArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args WorkflowArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args WorkflowArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args WorkflowArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args WorkflowArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var workflowResource = new Keycloak.Workflow("workflowResource", new()
{
    On = "string",
    Realm = "string",
    Steps = new[]
    {
        new Keycloak.Inputs.WorkflowStepArgs
        {
            Uses = "string",
            After = "string",
            Config = 
            {
                { "string", "string" },
            },
            Priority = "string",
            ScheduledAt = 0,
            Status = "string",
        },
    },
    CancelInProgress = "string",
    Conditions = "string",
    Enabled = false,
    Name = "string",
    RestartInProgress = "string",
    Schedule = new Keycloak.Inputs.WorkflowScheduleArgs
    {
        After = "string",
        BatchSize = 0,
    },
});

    example, err := keycloak.NewWorkflow(ctx, "workflowResource", &keycloak.WorkflowArgs{
	On:    pulumi.String("string"),
	Realm: pulumi.String("string"),
	Steps: keycloak.WorkflowStepArray{
		&keycloak.WorkflowStepArgs{
			Uses:  pulumi.String("string"),
			After: pulumi.String("string"),
			Config: pulumi.StringMap{
				"string": pulumi.String("string"),
			},
			Priority:    pulumi.String("string"),
			ScheduledAt: pulumi.Int(0),
			Status:      pulumi.String("string"),
		},
	},
	CancelInProgress:  pulumi.String("string"),
	Conditions:        pulumi.String("string"),
	Enabled:           pulumi.Bool(false),
	Name:              pulumi.String("string"),
	RestartInProgress: pulumi.String("string"),
	Schedule: &keycloak.WorkflowScheduleArgs{
		After:     pulumi.String("string"),
		BatchSize: pulumi.Int(0),
	},
})

    resource "keycloak_workflow" "workflowResource" {
  lifecycle {
    create_before_destroy = true
  }
  on    = "string"
  realm = "string"
  steps {
    uses  = "string"
    after = "string"
    config = {
      "string" = "string"
    }
    priority     = "string"
    scheduled_at = 0
    status       = "string"
  }
  cancel_in_progress  = "string"
  conditions          = "string"
  enabled             = false
  name                = "string"
  restart_in_progress = "string"
  schedule = {
    after      = "string"
    batch_size = 0
  }
}

    var workflowResource = new Workflow("workflowResource", WorkflowArgs.builder()
    .on("string")
    .realm("string")
    .steps(WorkflowStepArgs.builder()
        .uses("string")
        .after("string")
        .config(Map.of("string", "string"))
        .priority("string")
        .scheduledAt(0)
        .status("string")
        .build())
    .cancelInProgress("string")
    .conditions("string")
    .enabled(false)
    .name("string")
    .restartInProgress("string")
    .schedule(WorkflowScheduleArgs.builder()
        .after("string")
        .batchSize(0)
        .build())
    .build());

    workflow_resource = keycloak.Workflow("workflowResource",
    on="string",
    realm="string",
    steps=[{
        "uses": "string",
        "after": "string",
        "config": {
            "string": "string",
        },
        "priority": "string",
        "scheduled_at": 0,
        "status": "string",
    }],
    cancel_in_progress="string",
    conditions="string",
    enabled=False,
    name="string",
    restart_in_progress="string",
    schedule={
        "after": "string",
        "batch_size": 0,
    })

    const workflowResource = new keycloak.Workflow("workflowResource", {
    on: "string",
    realm: "string",
    steps: [{
        uses: "string",
        after: "string",
        config: {
            string: "string",
        },
        priority: "string",
        scheduledAt: 0,
        status: "string",
    }],
    cancelInProgress: "string",
    conditions: "string",
    enabled: false,
    name: "string",
    restartInProgress: "string",
    schedule: {
        after: "string",
        batchSize: 0,
    },
});

    type: keycloak:Workflow
properties:
    cancelInProgress: string
    conditions: string
    enabled: false
    name: string
    "on": string
    realm: string
    restartInProgress: string
    schedule:
        after: string
        batchSize: 0
    steps:
        - after: string
          config:
            string: string
          priority: string
          scheduledAt: 0
          status: string
          uses: string

    Workflow Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Workflow resource accepts the following input properties:

    On string
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    Realm string
    The realm this workflow exists in. Changing this forces a new resource.
    Steps List<WorkflowStep>
    One or more step blocks defining the actions to execute, in order.
    CancelInProgress string
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    Conditions string
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    Enabled bool
    Whether the workflow is enabled. Defaults to true.
    Name string
    The name of the workflow.
    RestartInProgress string
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    Schedule WorkflowSchedule
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    On string
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    Realm string
    The realm this workflow exists in. Changing this forces a new resource.
    Steps []WorkflowStepArgs
    One or more step blocks defining the actions to execute, in order.
    CancelInProgress string
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    Conditions string
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    Enabled bool
    Whether the workflow is enabled. Defaults to true.
    Name string
    The name of the workflow.
    RestartInProgress string
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    Schedule WorkflowScheduleArgs
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    on string
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    realm string
    The realm this workflow exists in. Changing this forces a new resource.
    steps list(object)
    One or more step blocks defining the actions to execute, in order.
    cancel_in_progress string
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    conditions string
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    enabled bool
    Whether the workflow is enabled. Defaults to true.
    name string
    The name of the workflow.
    restart_in_progress string
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    schedule object
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    on String
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    realm String
    The realm this workflow exists in. Changing this forces a new resource.
    steps List<WorkflowStep>
    One or more step blocks defining the actions to execute, in order.
    cancelInProgress String
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    conditions String
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    enabled Boolean
    Whether the workflow is enabled. Defaults to true.
    name String
    The name of the workflow.
    restartInProgress String
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    schedule WorkflowSchedule
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    on string
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    realm string
    The realm this workflow exists in. Changing this forces a new resource.
    steps WorkflowStep[]
    One or more step blocks defining the actions to execute, in order.
    cancelInProgress string
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    conditions string
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    enabled boolean
    Whether the workflow is enabled. Defaults to true.
    name string
    The name of the workflow.
    restartInProgress string
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    schedule WorkflowSchedule
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    on str
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    realm str
    The realm this workflow exists in. Changing this forces a new resource.
    steps Sequence[WorkflowStepArgs]
    One or more step blocks defining the actions to execute, in order.
    cancel_in_progress str
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    conditions str
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    enabled bool
    Whether the workflow is enabled. Defaults to true.
    name str
    The name of the workflow.
    restart_in_progress str
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    schedule WorkflowScheduleArgs
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    on String
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    realm String
    The realm this workflow exists in. Changing this forces a new resource.
    steps List<Property Map>
    One or more step blocks defining the actions to execute, in order.
    cancelInProgress String
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    conditions String
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    enabled Boolean
    Whether the workflow is enabled. Defaults to true.
    name String
    The name of the workflow.
    restartInProgress String
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    schedule Property Map
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Workflow resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    States List<WorkflowState>
    The runtime state of the workflow as reported by Keycloak. Contains:
    Id string
    The provider-assigned unique ID for this managed resource.
    States []WorkflowStateType
    The runtime state of the workflow as reported by Keycloak. Contains:
    id string
    The provider-assigned unique ID for this managed resource.
    states list(object)
    The runtime state of the workflow as reported by Keycloak. Contains:
    id String
    The provider-assigned unique ID for this managed resource.
    states List<WorkflowState>
    The runtime state of the workflow as reported by Keycloak. Contains:
    id string
    The provider-assigned unique ID for this managed resource.
    states WorkflowState[]
    The runtime state of the workflow as reported by Keycloak. Contains:
    id str
    The provider-assigned unique ID for this managed resource.
    states Sequence[WorkflowState]
    The runtime state of the workflow as reported by Keycloak. Contains:
    id String
    The provider-assigned unique ID for this managed resource.
    states List<Property Map>
    The runtime state of the workflow as reported by Keycloak. Contains:

    Look up Existing Workflow Resource

    Get an existing Workflow resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: WorkflowState, opts?: CustomResourceOptions): Workflow
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        cancel_in_progress: Optional[str] = None,
        conditions: Optional[str] = None,
        enabled: Optional[bool] = None,
        name: Optional[str] = None,
        on: Optional[str] = None,
        realm: Optional[str] = None,
        restart_in_progress: Optional[str] = None,
        schedule: Optional[WorkflowScheduleArgs] = None,
        states: Optional[Sequence[WorkflowStateArgs]] = None,
        steps: Optional[Sequence[WorkflowStepArgs]] = None) -> Workflow
    func GetWorkflow(ctx *Context, name string, id IDInput, state *WorkflowState, opts ...ResourceOption) (*Workflow, error)
    public static Workflow Get(string name, Input<string> id, WorkflowState? state, CustomResourceOptions? opts = null)
    public static Workflow get(String name, Output<String> id, WorkflowState state, CustomResourceOptions options)
    resources:  _:    type: keycloak:Workflow    get:      id: ${id}
    import {
  to = keycloak_workflow.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CancelInProgress string
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    Conditions string
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    Enabled bool
    Whether the workflow is enabled. Defaults to true.
    Name string
    The name of the workflow.
    On string
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    Realm string
    The realm this workflow exists in. Changing this forces a new resource.
    RestartInProgress string
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    Schedule WorkflowSchedule
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    States List<WorkflowState>
    The runtime state of the workflow as reported by Keycloak. Contains:
    Steps List<WorkflowStep>
    One or more step blocks defining the actions to execute, in order.
    CancelInProgress string
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    Conditions string
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    Enabled bool
    Whether the workflow is enabled. Defaults to true.
    Name string
    The name of the workflow.
    On string
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    Realm string
    The realm this workflow exists in. Changing this forces a new resource.
    RestartInProgress string
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    Schedule WorkflowScheduleArgs
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    States []WorkflowStateTypeArgs
    The runtime state of the workflow as reported by Keycloak. Contains:
    Steps []WorkflowStepArgs
    One or more step blocks defining the actions to execute, in order.
    cancel_in_progress string
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    conditions string
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    enabled bool
    Whether the workflow is enabled. Defaults to true.
    name string
    The name of the workflow.
    on string
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    realm string
    The realm this workflow exists in. Changing this forces a new resource.
    restart_in_progress string
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    schedule object
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    states list(object)
    The runtime state of the workflow as reported by Keycloak. Contains:
    steps list(object)
    One or more step blocks defining the actions to execute, in order.
    cancelInProgress String
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    conditions String
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    enabled Boolean
    Whether the workflow is enabled. Defaults to true.
    name String
    The name of the workflow.
    on String
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    realm String
    The realm this workflow exists in. Changing this forces a new resource.
    restartInProgress String
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    schedule WorkflowSchedule
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    states List<WorkflowState>
    The runtime state of the workflow as reported by Keycloak. Contains:
    steps List<WorkflowStep>
    One or more step blocks defining the actions to execute, in order.
    cancelInProgress string
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    conditions string
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    enabled boolean
    Whether the workflow is enabled. Defaults to true.
    name string
    The name of the workflow.
    on string
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    realm string
    The realm this workflow exists in. Changing this forces a new resource.
    restartInProgress string
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    schedule WorkflowSchedule
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    states WorkflowState[]
    The runtime state of the workflow as reported by Keycloak. Contains:
    steps WorkflowStep[]
    One or more step blocks defining the actions to execute, in order.
    cancel_in_progress str
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    conditions str
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    enabled bool
    Whether the workflow is enabled. Defaults to true.
    name str
    The name of the workflow.
    on str
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    realm str
    The realm this workflow exists in. Changing this forces a new resource.
    restart_in_progress str
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    schedule WorkflowScheduleArgs
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    states Sequence[WorkflowStateArgs]
    The runtime state of the workflow as reported by Keycloak. Contains:
    steps Sequence[WorkflowStepArgs]
    One or more step blocks defining the actions to execute, in order.
    cancelInProgress String
    Whether to cancel an already in-progress execution when the workflow is re-triggered for the same resource. Set to "true" to enable.
    conditions String
    An expression that must evaluate to true for the workflow to run (e.g. has-role('some-role')).
    enabled Boolean
    Whether the workflow is enabled. Defaults to true.
    name String
    The name of the workflow.
    on String
    The realm event that triggers the workflow. Supported values: userCreated, userRemoved, userAuthenticated, userFederatedIdentityAdded, userFederatedIdentityRemoved, userGroupMembershipAdded, userGroupMembershipRemoved, userRoleGranted, userRoleRevoked.
    realm String
    The realm this workflow exists in. Changing this forces a new resource.
    restartInProgress String
    Whether to restart an already in-progress execution (resetting it to the first step) when the workflow is re-triggered for the same resource. Set to "true" to enable.
    schedule Property Map
    A schedule block that makes the workflow run periodically over matching realm resources instead of (or in addition to) reacting to a single event.
    states List<Property Map>
    The runtime state of the workflow as reported by Keycloak. Contains:
    steps List<Property Map>
    One or more step blocks defining the actions to execute, in order.

    Supporting Types

    WorkflowSchedule, WorkflowScheduleArgs

    After string
    Interval between successive scheduled runs, as a duration string (e.g. 30s, 1d) or milliseconds.
    BatchSize int
    Maximum number of resources processed per scheduled batch.
    After string
    Interval between successive scheduled runs, as a duration string (e.g. 30s, 1d) or milliseconds.
    BatchSize int
    Maximum number of resources processed per scheduled batch.
    after string
    Interval between successive scheduled runs, as a duration string (e.g. 30s, 1d) or milliseconds.
    batch_size number
    Maximum number of resources processed per scheduled batch.
    after String
    Interval between successive scheduled runs, as a duration string (e.g. 30s, 1d) or milliseconds.
    batchSize Integer
    Maximum number of resources processed per scheduled batch.
    after string
    Interval between successive scheduled runs, as a duration string (e.g. 30s, 1d) or milliseconds.
    batchSize number
    Maximum number of resources processed per scheduled batch.
    after str
    Interval between successive scheduled runs, as a duration string (e.g. 30s, 1d) or milliseconds.
    batch_size int
    Maximum number of resources processed per scheduled batch.
    after String
    Interval between successive scheduled runs, as a duration string (e.g. 30s, 1d) or milliseconds.
    batchSize Number
    Maximum number of resources processed per scheduled batch.

    WorkflowState, WorkflowStateArgs

    Errors List<string>
    A list of error messages recorded for the workflow.

    • Each step block additionally exports:
    Errors []string
    A list of error messages recorded for the workflow.

    • Each step block additionally exports:
    errors list(string)
    A list of error messages recorded for the workflow.

    • Each step block additionally exports:
    errors List<String>
    A list of error messages recorded for the workflow.

    • Each step block additionally exports:
    errors string[]
    A list of error messages recorded for the workflow.

    • Each step block additionally exports:
    errors Sequence[str]
    A list of error messages recorded for the workflow.

    • Each step block additionally exports:
    errors List<String>
    A list of error messages recorded for the workflow.

    • Each step block additionally exports:

    WorkflowStep, WorkflowStepArgs

    Uses string
    The step type to execute (e.g. disable-user, delete-user, notify-user).
    After string
    Delay before executing this step, as a duration string (e.g. 7d) or milliseconds (e.g. 2592000000).
    Config Dictionary<string, string>
    Key-value configuration for the step.
    Priority string
    Execution priority of the step, used to order steps that would otherwise run at the same time.
    ScheduledAt int
    Epoch timestamp in milliseconds at which the step is scheduled to execute.
    Status string
    The execution status of the step.
    Uses string
    The step type to execute (e.g. disable-user, delete-user, notify-user).
    After string
    Delay before executing this step, as a duration string (e.g. 7d) or milliseconds (e.g. 2592000000).
    Config map[string]string
    Key-value configuration for the step.
    Priority string
    Execution priority of the step, used to order steps that would otherwise run at the same time.
    ScheduledAt int
    Epoch timestamp in milliseconds at which the step is scheduled to execute.
    Status string
    The execution status of the step.
    uses string
    The step type to execute (e.g. disable-user, delete-user, notify-user).
    after string
    Delay before executing this step, as a duration string (e.g. 7d) or milliseconds (e.g. 2592000000).
    config map(string)
    Key-value configuration for the step.
    priority string
    Execution priority of the step, used to order steps that would otherwise run at the same time.
    scheduled_at number
    Epoch timestamp in milliseconds at which the step is scheduled to execute.
    status string
    The execution status of the step.
    uses String
    The step type to execute (e.g. disable-user, delete-user, notify-user).
    after String
    Delay before executing this step, as a duration string (e.g. 7d) or milliseconds (e.g. 2592000000).
    config Map<String,String>
    Key-value configuration for the step.
    priority String
    Execution priority of the step, used to order steps that would otherwise run at the same time.
    scheduledAt Integer
    Epoch timestamp in milliseconds at which the step is scheduled to execute.
    status String
    The execution status of the step.
    uses string
    The step type to execute (e.g. disable-user, delete-user, notify-user).
    after string
    Delay before executing this step, as a duration string (e.g. 7d) or milliseconds (e.g. 2592000000).
    config {[key: string]: string}
    Key-value configuration for the step.
    priority string
    Execution priority of the step, used to order steps that would otherwise run at the same time.
    scheduledAt number
    Epoch timestamp in milliseconds at which the step is scheduled to execute.
    status string
    The execution status of the step.
    uses str
    The step type to execute (e.g. disable-user, delete-user, notify-user).
    after str
    Delay before executing this step, as a duration string (e.g. 7d) or milliseconds (e.g. 2592000000).
    config Mapping[str, str]
    Key-value configuration for the step.
    priority str
    Execution priority of the step, used to order steps that would otherwise run at the same time.
    scheduled_at int
    Epoch timestamp in milliseconds at which the step is scheduled to execute.
    status str
    The execution status of the step.
    uses String
    The step type to execute (e.g. disable-user, delete-user, notify-user).
    after String
    Delay before executing this step, as a duration string (e.g. 7d) or milliseconds (e.g. 2592000000).
    config Map<String>
    Key-value configuration for the step.
    priority String
    Execution priority of the step, used to order steps that would otherwise run at the same time.
    scheduledAt Number
    Epoch timestamp in milliseconds at which the step is scheduled to execute.
    status String
    The execution status of the step.

    Import

    Workflows can be imported using the format {{realm}}/{{workflow_id}}, where realm is the realm name and workflowId is the unique ID Keycloak assigns upon creation.

    $ pulumi import keycloak:index/workflow:Workflow disable_inactive my-realm/cec54914-b702-4c7b-9431-b407817d059a

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Keycloak pulumi/pulumi-keycloak
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the keycloak Terraform Provider.
    keycloak logo keycloak logo
    Viewing docs for Keycloak v6.13.0
    published on Saturday, Aug 1, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-keycloak

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial