Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Konnect Provider
  4. API Docs
  5. IdentityVaultProvider
Viewing docs for konnect 3.28.0
published on Friday, Nov 6, 2026 by kong
Schema (JSON)
kong/terraform-provider-konnect

konnect.IdentityVaultProvider

konnect
Viewing docs for konnect 3.28.0
published on Friday, Nov 6, 2026 by kong
Schema (JSON)
kong/terraform-provider-konnect

    IdentityVaultProvider Resource

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as konnect from "@pulumi/konnect";

const myIdentityvaultprovider = new konnect.IdentityVaultProvider("my_identityvaultprovider", {
    authorizationEndpoint: "...my_authorization_endpoint...",
    clientId: "...my_client_id...",
    clientSecret: "...my_client_secret...",
    credentialType: "user",
    dcrEnabled: true,
    directoryId: "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
    name: "...my_name...",
    pkceEnabled: true,
    refreshBufferSeconds: 0,
    registrationEndpoint: "...my_registration_endpoint...",
    scopes: ["..."],
    templateName: "github",
    tokenEndpoint: "...my_token_endpoint...",
});

    import pulumi
import pulumi_konnect as konnect

my_identityvaultprovider = konnect.IdentityVaultProvider("my_identityvaultprovider",
    authorization_endpoint="...my_authorization_endpoint...",
    client_id="...my_client_id...",
    client_secret="...my_client_secret...",
    credential_type="user",
    dcr_enabled=True,
    directory_id="5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
    name="...my_name...",
    pkce_enabled=True,
    refresh_buffer_seconds=0,
    registration_endpoint="...my_registration_endpoint...",
    scopes=["..."],
    template_name="github",
    token_endpoint="...my_token_endpoint...")

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/konnect/v3/konnect"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := konnect.NewIdentityVaultProvider(ctx, "my_identityvaultprovider", &konnect.IdentityVaultProviderArgs{
			AuthorizationEndpoint: pulumi.String("...my_authorization_endpoint..."),
			ClientId:              pulumi.String("...my_client_id..."),
			ClientSecret:          pulumi.String("...my_client_secret..."),
			CredentialType:        pulumi.String("user"),
			DcrEnabled:            pulumi.Bool(true),
			DirectoryId:           pulumi.String("5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"),
			Name:                  pulumi.String("...my_name..."),
			PkceEnabled:           pulumi.Bool(true),
			RefreshBufferSeconds:  pulumi.Float64(0),
			RegistrationEndpoint:  pulumi.String("...my_registration_endpoint..."),
			Scopes: pulumi.StringArray{
				pulumi.String("..."),
			},
			TemplateName:  pulumi.String("github"),
			TokenEndpoint: pulumi.String("...my_token_endpoint..."),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Konnect = Pulumi.Konnect;

return await Deployment.RunAsync(() => 
{
    var myIdentityvaultprovider = new Konnect.IdentityVaultProvider("my_identityvaultprovider", new()
    {
        AuthorizationEndpoint = "...my_authorization_endpoint...",
        ClientId = "...my_client_id...",
        ClientSecret = "...my_client_secret...",
        CredentialType = "user",
        DcrEnabled = true,
        DirectoryId = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
        Name = "...my_name...",
        PkceEnabled = true,
        RefreshBufferSeconds = 0,
        RegistrationEndpoint = "...my_registration_endpoint...",
        Scopes = new[]
        {
            "...",
        },
        TemplateName = "github",
        TokenEndpoint = "...my_token_endpoint...",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.konnect.IdentityVaultProvider;
import com.pulumi.konnect.IdentityVaultProviderArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var myIdentityvaultprovider = new IdentityVaultProvider("myIdentityvaultprovider", IdentityVaultProviderArgs.builder()
            .authorizationEndpoint("...my_authorization_endpoint...")
            .clientId("...my_client_id...")
            .clientSecret("...my_client_secret...")
            .credentialType("user")
            .dcrEnabled(true)
            .directoryId("5f9fd312-a987-4628-b4c5-bb4f4fddd5f7")
            .name("...my_name...")
            .pkceEnabled(true)
            .refreshBufferSeconds(0.0)
            .registrationEndpoint("...my_registration_endpoint...")
            .scopes("...")
            .templateName("github")
            .tokenEndpoint("...my_token_endpoint...")
            .build());

    }
}

    resources:
  myIdentityvaultprovider:
    type: konnect:IdentityVaultProvider
    name: my_identityvaultprovider
    properties:
      authorizationEndpoint: '...my_authorization_endpoint...'
      clientId: '...my_client_id...'
      clientSecret: '...my_client_secret...'
      credentialType: user
      dcrEnabled: true
      directoryId: 5f9fd312-a987-4628-b4c5-bb4f4fddd5f7
      name: '...my_name...'
      pkceEnabled: true
      refreshBufferSeconds: 0
      registrationEndpoint: '...my_registration_endpoint...'
      scopes:
        - '...'
      templateName: github
      tokenEndpoint: '...my_token_endpoint...'

    Example coming soon!

    Create IdentityVaultProvider Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new IdentityVaultProvider(name: string, args: IdentityVaultProviderArgs, opts?: CustomResourceOptions);
    @overload
def IdentityVaultProvider(resource_name: str,
                          args: IdentityVaultProviderArgs,
                          opts: Optional[ResourceOptions] = None)

@overload
def IdentityVaultProvider(resource_name: str,
                          opts: Optional[ResourceOptions] = None,
                          directory_id: Optional[str] = None,
                          template_name: Optional[str] = None,
                          name: Optional[str] = None,
                          credential_type: Optional[str] = None,
                          dcr_enabled: Optional[bool] = None,
                          client_secret: Optional[str] = None,
                          authorization_endpoint: Optional[str] = None,
                          pkce_enabled: Optional[bool] = None,
                          refresh_buffer_seconds: Optional[float] = None,
                          registration_endpoint: Optional[str] = None,
                          scopes: Optional[Sequence[str]] = None,
                          client_id: Optional[str] = None,
                          token_endpoint: Optional[str] = None)
    func NewIdentityVaultProvider(ctx *Context, name string, args IdentityVaultProviderArgs, opts ...ResourceOption) (*IdentityVaultProvider, error)
    public IdentityVaultProvider(string name, IdentityVaultProviderArgs args, CustomResourceOptions? opts = null)
    public IdentityVaultProvider(String name, IdentityVaultProviderArgs args)
public IdentityVaultProvider(String name, IdentityVaultProviderArgs args, CustomResourceOptions options)

    type: konnect:IdentityVaultProvider
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "konnect_identity_vault_provider" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args IdentityVaultProviderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args IdentityVaultProviderArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args IdentityVaultProviderArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args IdentityVaultProviderArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args IdentityVaultProviderArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var identityVaultProviderResource = new Konnect.IdentityVaultProvider("identityVaultProviderResource", new()
{
    DirectoryId = "string",
    TemplateName = "string",
    Name = "string",
    CredentialType = "string",
    DcrEnabled = false,
    ClientSecret = "string",
    AuthorizationEndpoint = "string",
    PkceEnabled = false,
    RefreshBufferSeconds = 0.0,
    RegistrationEndpoint = "string",
    Scopes = new[]
    {
        "string",
    },
    ClientId = "string",
    TokenEndpoint = "string",
});

    example, err := konnect.NewIdentityVaultProvider(ctx, "identityVaultProviderResource", &konnect.IdentityVaultProviderArgs{
	DirectoryId:           pulumi.String("string"),
	TemplateName:          pulumi.String("string"),
	Name:                  pulumi.String("string"),
	CredentialType:        pulumi.String("string"),
	DcrEnabled:            pulumi.Bool(false),
	ClientSecret:          pulumi.String("string"),
	AuthorizationEndpoint: pulumi.String("string"),
	PkceEnabled:           pulumi.Bool(false),
	RefreshBufferSeconds:  pulumi.Float64(0),
	RegistrationEndpoint:  pulumi.String("string"),
	Scopes: pulumi.StringArray{
		pulumi.String("string"),
	},
	ClientId:      pulumi.String("string"),
	TokenEndpoint: pulumi.String("string"),
})

    resource "konnect_identity_vault_provider" "identityVaultProviderResource" {
  lifecycle {
    create_before_destroy = true
  }
  directory_id           = "string"
  template_name          = "string"
  name                   = "string"
  credential_type        = "string"
  dcr_enabled            = false
  client_secret          = "string"
  authorization_endpoint = "string"
  pkce_enabled           = false
  refresh_buffer_seconds = 0
  registration_endpoint  = "string"
  scopes                 = ["string"]
  client_id              = "string"
  token_endpoint         = "string"
}

    var identityVaultProviderResource = new IdentityVaultProvider("identityVaultProviderResource", IdentityVaultProviderArgs.builder()
    .directoryId("string")
    .templateName("string")
    .name("string")
    .credentialType("string")
    .dcrEnabled(false)
    .clientSecret("string")
    .authorizationEndpoint("string")
    .pkceEnabled(false)
    .refreshBufferSeconds(0.0)
    .registrationEndpoint("string")
    .scopes("string")
    .clientId("string")
    .tokenEndpoint("string")
    .build());

    identity_vault_provider_resource = konnect.IdentityVaultProvider("identityVaultProviderResource",
    directory_id="string",
    template_name="string",
    name="string",
    credential_type="string",
    dcr_enabled=False,
    client_secret="string",
    authorization_endpoint="string",
    pkce_enabled=False,
    refresh_buffer_seconds=float(0),
    registration_endpoint="string",
    scopes=["string"],
    client_id="string",
    token_endpoint="string")

    const identityVaultProviderResource = new konnect.IdentityVaultProvider("identityVaultProviderResource", {
    directoryId: "string",
    templateName: "string",
    name: "string",
    credentialType: "string",
    dcrEnabled: false,
    clientSecret: "string",
    authorizationEndpoint: "string",
    pkceEnabled: false,
    refreshBufferSeconds: 0,
    registrationEndpoint: "string",
    scopes: ["string"],
    clientId: "string",
    tokenEndpoint: "string",
});

    type: konnect:IdentityVaultProvider
properties:
    authorizationEndpoint: string
    clientId: string
    clientSecret: string
    credentialType: string
    dcrEnabled: false
    directoryId: string
    name: string
    pkceEnabled: false
    refreshBufferSeconds: 0
    registrationEndpoint: string
    scopes:
        - string
    templateName: string
    tokenEndpoint: string

    IdentityVaultProvider Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The IdentityVaultProvider resource accepts the following input properties:

    DirectoryId string
    ID of the directory
    TemplateName string
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    AuthorizationEndpoint string
    Overrides the template authorization endpoint.
    ClientId string
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    ClientSecret string
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    CredentialType string
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    DcrEnabled bool
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    Name string
    PkceEnabled bool
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    RefreshBufferSeconds double
    Default: 0
    RegistrationEndpoint string
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    Scopes List<string>
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    TokenEndpoint string
    Overrides the template token endpoint.
    DirectoryId string
    ID of the directory
    TemplateName string
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    AuthorizationEndpoint string
    Overrides the template authorization endpoint.
    ClientId string
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    ClientSecret string
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    CredentialType string
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    DcrEnabled bool
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    Name string
    PkceEnabled bool
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    RefreshBufferSeconds float64
    Default: 0
    RegistrationEndpoint string
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    Scopes []string
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    TokenEndpoint string
    Overrides the template token endpoint.
    directory_id string
    ID of the directory
    template_name string
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    authorization_endpoint string
    Overrides the template authorization endpoint.
    client_id string
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    client_secret string
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    credential_type string
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    dcr_enabled bool
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    name string
    pkce_enabled bool
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    refresh_buffer_seconds number
    Default: 0
    registration_endpoint string
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    scopes list(string)
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    token_endpoint string
    Overrides the template token endpoint.
    directoryId String
    ID of the directory
    templateName String
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    authorizationEndpoint String
    Overrides the template authorization endpoint.
    clientId String
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    clientSecret String
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    credentialType String
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    dcrEnabled Boolean
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    name String
    pkceEnabled Boolean
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    refreshBufferSeconds Double
    Default: 0
    registrationEndpoint String
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    scopes List<String>
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    tokenEndpoint String
    Overrides the template token endpoint.
    directoryId string
    ID of the directory
    templateName string
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    authorizationEndpoint string
    Overrides the template authorization endpoint.
    clientId string
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    clientSecret string
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    credentialType string
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    dcrEnabled boolean
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    name string
    pkceEnabled boolean
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    refreshBufferSeconds number
    Default: 0
    registrationEndpoint string
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    scopes string[]
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    tokenEndpoint string
    Overrides the template token endpoint.
    directory_id str
    ID of the directory
    template_name str
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    authorization_endpoint str
    Overrides the template authorization endpoint.
    client_id str
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    client_secret str
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    credential_type str
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    dcr_enabled bool
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    name str
    pkce_enabled bool
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    refresh_buffer_seconds float
    Default: 0
    registration_endpoint str
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    scopes Sequence[str]
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    token_endpoint str
    Overrides the template token endpoint.
    directoryId String
    ID of the directory
    templateName String
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    authorizationEndpoint String
    Overrides the template authorization endpoint.
    clientId String
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    clientSecret String
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    credentialType String
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    dcrEnabled Boolean
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    name String
    pkceEnabled Boolean
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    refreshBufferSeconds Number
    Default: 0
    registrationEndpoint String
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    scopes List<String>
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    tokenEndpoint String
    Overrides the template token endpoint.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the IdentityVaultProvider resource produces the following output properties:

    AuthorizationEndpointEffective string
    Resolved authorization endpoint (provider override or template default).
    BearerMethodsSupporteds List<string>
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Enabled bool
    Defines if the provider is enabled or not
    Id string
    The provider-assigned unique ID for this managed resource.
    RegistrationEndpointEffective string
    Resolved DCR registration endpoint (provider override or template default).
    TokenEndpointEffective string
    Resolved token endpoint (provider override or template default).
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    AuthorizationEndpointEffective string
    Resolved authorization endpoint (provider override or template default).
    BearerMethodsSupporteds []string
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    Enabled bool
    Defines if the provider is enabled or not
    Id string
    The provider-assigned unique ID for this managed resource.
    RegistrationEndpointEffective string
    Resolved DCR registration endpoint (provider override or template default).
    TokenEndpointEffective string
    Resolved token endpoint (provider override or template default).
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    authorization_endpoint_effective string
    Resolved authorization endpoint (provider override or template default).
    bearer_methods_supporteds list(string)
    created_at string
    An ISO-8601 timestamp representation of entity creation date.
    enabled bool
    Defines if the provider is enabled or not
    id string
    The provider-assigned unique ID for this managed resource.
    registration_endpoint_effective string
    Resolved DCR registration endpoint (provider override or template default).
    token_endpoint_effective string
    Resolved token endpoint (provider override or template default).
    updated_at string
    An ISO-8601 timestamp representation of entity update date.
    authorizationEndpointEffective String
    Resolved authorization endpoint (provider override or template default).
    bearerMethodsSupporteds List<String>
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    enabled Boolean
    Defines if the provider is enabled or not
    id String
    The provider-assigned unique ID for this managed resource.
    registrationEndpointEffective String
    Resolved DCR registration endpoint (provider override or template default).
    tokenEndpointEffective String
    Resolved token endpoint (provider override or template default).
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.
    authorizationEndpointEffective string
    Resolved authorization endpoint (provider override or template default).
    bearerMethodsSupporteds string[]
    createdAt string
    An ISO-8601 timestamp representation of entity creation date.
    enabled boolean
    Defines if the provider is enabled or not
    id string
    The provider-assigned unique ID for this managed resource.
    registrationEndpointEffective string
    Resolved DCR registration endpoint (provider override or template default).
    tokenEndpointEffective string
    Resolved token endpoint (provider override or template default).
    updatedAt string
    An ISO-8601 timestamp representation of entity update date.
    authorization_endpoint_effective str
    Resolved authorization endpoint (provider override or template default).
    bearer_methods_supporteds Sequence[str]
    created_at str
    An ISO-8601 timestamp representation of entity creation date.
    enabled bool
    Defines if the provider is enabled or not
    id str
    The provider-assigned unique ID for this managed resource.
    registration_endpoint_effective str
    Resolved DCR registration endpoint (provider override or template default).
    token_endpoint_effective str
    Resolved token endpoint (provider override or template default).
    updated_at str
    An ISO-8601 timestamp representation of entity update date.
    authorizationEndpointEffective String
    Resolved authorization endpoint (provider override or template default).
    bearerMethodsSupporteds List<String>
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    enabled Boolean
    Defines if the provider is enabled or not
    id String
    The provider-assigned unique ID for this managed resource.
    registrationEndpointEffective String
    Resolved DCR registration endpoint (provider override or template default).
    tokenEndpointEffective String
    Resolved token endpoint (provider override or template default).
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.

    Look up Existing IdentityVaultProvider Resource

    Get an existing IdentityVaultProvider resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: IdentityVaultProviderState, opts?: CustomResourceOptions): IdentityVaultProvider
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        authorization_endpoint: Optional[str] = None,
        authorization_endpoint_effective: Optional[str] = None,
        bearer_methods_supporteds: Optional[Sequence[str]] = None,
        client_id: Optional[str] = None,
        client_secret: Optional[str] = None,
        created_at: Optional[str] = None,
        credential_type: Optional[str] = None,
        dcr_enabled: Optional[bool] = None,
        directory_id: Optional[str] = None,
        enabled: Optional[bool] = None,
        name: Optional[str] = None,
        pkce_enabled: Optional[bool] = None,
        refresh_buffer_seconds: Optional[float] = None,
        registration_endpoint: Optional[str] = None,
        registration_endpoint_effective: Optional[str] = None,
        scopes: Optional[Sequence[str]] = None,
        template_name: Optional[str] = None,
        token_endpoint: Optional[str] = None,
        token_endpoint_effective: Optional[str] = None,
        updated_at: Optional[str] = None) -> IdentityVaultProvider
    func GetIdentityVaultProvider(ctx *Context, name string, id IDInput, state *IdentityVaultProviderState, opts ...ResourceOption) (*IdentityVaultProvider, error)
    public static IdentityVaultProvider Get(string name, Input<string> id, IdentityVaultProviderState? state, CustomResourceOptions? opts = null)
    public static IdentityVaultProvider get(String name, Output<String> id, IdentityVaultProviderState state, CustomResourceOptions options)
    resources:  _:    type: konnect:IdentityVaultProvider    get:      id: ${id}
    import {
  to = konnect_identity_vault_provider.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AuthorizationEndpoint string
    Overrides the template authorization endpoint.
    AuthorizationEndpointEffective string
    Resolved authorization endpoint (provider override or template default).
    BearerMethodsSupporteds List<string>
    ClientId string
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    ClientSecret string
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    CredentialType string
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    DcrEnabled bool
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    DirectoryId string
    ID of the directory
    Enabled bool
    Defines if the provider is enabled or not
    Name string
    PkceEnabled bool
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    RefreshBufferSeconds double
    Default: 0
    RegistrationEndpoint string
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    RegistrationEndpointEffective string
    Resolved DCR registration endpoint (provider override or template default).
    Scopes List<string>
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    TemplateName string
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    TokenEndpoint string
    Overrides the template token endpoint.
    TokenEndpointEffective string
    Resolved token endpoint (provider override or template default).
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    AuthorizationEndpoint string
    Overrides the template authorization endpoint.
    AuthorizationEndpointEffective string
    Resolved authorization endpoint (provider override or template default).
    BearerMethodsSupporteds []string
    ClientId string
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    ClientSecret string
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    CreatedAt string
    An ISO-8601 timestamp representation of entity creation date.
    CredentialType string
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    DcrEnabled bool
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    DirectoryId string
    ID of the directory
    Enabled bool
    Defines if the provider is enabled or not
    Name string
    PkceEnabled bool
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    RefreshBufferSeconds float64
    Default: 0
    RegistrationEndpoint string
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    RegistrationEndpointEffective string
    Resolved DCR registration endpoint (provider override or template default).
    Scopes []string
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    TemplateName string
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    TokenEndpoint string
    Overrides the template token endpoint.
    TokenEndpointEffective string
    Resolved token endpoint (provider override or template default).
    UpdatedAt string
    An ISO-8601 timestamp representation of entity update date.
    authorization_endpoint string
    Overrides the template authorization endpoint.
    authorization_endpoint_effective string
    Resolved authorization endpoint (provider override or template default).
    bearer_methods_supporteds list(string)
    client_id string
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    client_secret string
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    created_at string
    An ISO-8601 timestamp representation of entity creation date.
    credential_type string
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    dcr_enabled bool
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    directory_id string
    ID of the directory
    enabled bool
    Defines if the provider is enabled or not
    name string
    pkce_enabled bool
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    refresh_buffer_seconds number
    Default: 0
    registration_endpoint string
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    registration_endpoint_effective string
    Resolved DCR registration endpoint (provider override or template default).
    scopes list(string)
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    template_name string
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    token_endpoint string
    Overrides the template token endpoint.
    token_endpoint_effective string
    Resolved token endpoint (provider override or template default).
    updated_at string
    An ISO-8601 timestamp representation of entity update date.
    authorizationEndpoint String
    Overrides the template authorization endpoint.
    authorizationEndpointEffective String
    Resolved authorization endpoint (provider override or template default).
    bearerMethodsSupporteds List<String>
    clientId String
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    clientSecret String
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    credentialType String
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    dcrEnabled Boolean
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    directoryId String
    ID of the directory
    enabled Boolean
    Defines if the provider is enabled or not
    name String
    pkceEnabled Boolean
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    refreshBufferSeconds Double
    Default: 0
    registrationEndpoint String
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    registrationEndpointEffective String
    Resolved DCR registration endpoint (provider override or template default).
    scopes List<String>
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    templateName String
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    tokenEndpoint String
    Overrides the template token endpoint.
    tokenEndpointEffective String
    Resolved token endpoint (provider override or template default).
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.
    authorizationEndpoint string
    Overrides the template authorization endpoint.
    authorizationEndpointEffective string
    Resolved authorization endpoint (provider override or template default).
    bearerMethodsSupporteds string[]
    clientId string
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    clientSecret string
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    createdAt string
    An ISO-8601 timestamp representation of entity creation date.
    credentialType string
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    dcrEnabled boolean
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    directoryId string
    ID of the directory
    enabled boolean
    Defines if the provider is enabled or not
    name string
    pkceEnabled boolean
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    refreshBufferSeconds number
    Default: 0
    registrationEndpoint string
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    registrationEndpointEffective string
    Resolved DCR registration endpoint (provider override or template default).
    scopes string[]
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    templateName string
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    tokenEndpoint string
    Overrides the template token endpoint.
    tokenEndpointEffective string
    Resolved token endpoint (provider override or template default).
    updatedAt string
    An ISO-8601 timestamp representation of entity update date.
    authorization_endpoint str
    Overrides the template authorization endpoint.
    authorization_endpoint_effective str
    Resolved authorization endpoint (provider override or template default).
    bearer_methods_supporteds Sequence[str]
    client_id str
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    client_secret str
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    created_at str
    An ISO-8601 timestamp representation of entity creation date.
    credential_type str
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    dcr_enabled bool
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    directory_id str
    ID of the directory
    enabled bool
    Defines if the provider is enabled or not
    name str
    pkce_enabled bool
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    refresh_buffer_seconds float
    Default: 0
    registration_endpoint str
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    registration_endpoint_effective str
    Resolved DCR registration endpoint (provider override or template default).
    scopes Sequence[str]
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    template_name str
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    token_endpoint str
    Overrides the template token endpoint.
    token_endpoint_effective str
    Resolved token endpoint (provider override or template default).
    updated_at str
    An ISO-8601 timestamp representation of entity update date.
    authorizationEndpoint String
    Overrides the template authorization endpoint.
    authorizationEndpointEffective String
    Resolved authorization endpoint (provider override or template default).
    bearerMethodsSupporteds List<String>
    clientId String
    OAuth client identifier. Applies only to OAuth templates (authorizationcode). Rejected with 400 for staticsecret templates.
    clientSecret String
    OAuth client secret. Applies only to OAuth templates. Rejected with 400 for static_secret templates. Write-only; never returned in read APIs.
    createdAt String
    An ISO-8601 timestamp representation of entity creation date.
    credentialType String
    Credential scope. Defaults to "user" for authorizationcode templates when omitted; staticsecret templates require "shared".
    dcrEnabled Boolean
    When true, requests Dynamic Client Registration (RFC 7591) instead of a static clientid. Requires a resolvable registrationendpoint (provider override or template default) and that clientid is omitted. Each principal using this provider is registered its own upstream OAuth client lazily, on first use. Templates that ship their own registration endpoint (e.g. datadog) are DCR-based: dcrenabled defaults to true when neither dcrenabled nor clientid is supplied, and supplying a client_id selects a static client. Requires replacement if changed.
    directoryId String
    ID of the directory
    enabled Boolean
    Defines if the provider is enabled or not
    name String
    pkceEnabled Boolean
    Use PKCE (S256) on the authorization-code flow. Templates whose authorization server mandates PKCE (pkce_required, e.g. datadog) imply true when this field is omitted; setting it explicitly to false is rejected with 400.
    refreshBufferSeconds Number
    Default: 0
    registrationEndpoint String
    Overrides the template DCR registration endpoint. Requires replacement if changed.
    registrationEndpointEffective String
    Resolved DCR registration endpoint (provider override or template default).
    scopes List<String>
    Requested OAuth scopes. Defaults to the full set of template default scopes when omitted. Each scope must be a valid RFC 6749 §3.3 scope-token.
    templateName String
    The static name of the vault provider template to base this provider on (e.g. "github"). For staticsecret, provide only name and credentialtype ("shared"); the credential is provisioned separately via the vault provider credentials API, and clientid/clientsecret are rejected. possible known values include one of ["github", "slack", "static_secret", "google", "atlassian-rovo", "datadog", "custom-oauth", "miro"]
    tokenEndpoint String
    Overrides the template token endpoint.
    tokenEndpointEffective String
    Resolved token endpoint (provider override or template default).
    updatedAt String
    An ISO-8601 timestamp representation of entity update date.

    Import

    In Terraform v1.5.0 and later, the import block can be used with the id attribute, for example:

    terraform

    import {

    to = konnect_identity_vault_provider.my_konnect_identity_vault_provider

    id = jsonencode({

    directory_id = "..."

id           = "..."

    })

    }

    The pulumi import command can be used, for example:

    $ pulumi import konnect:index/identityVaultProvider:IdentityVaultProvider my_konnect_identity_vault_provider '{"directory_id": "...", "id": "..."}'

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    konnect kong/terraform-provider-konnect
    License
    Notes
    This Pulumi package is based on the konnect Terraform Provider.
    konnect
    Viewing docs for konnect 3.28.0
    published on Friday, Nov 6, 2026 by kong
    Schema (JSON)
    kong/terraform-provider-konnect

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial