Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. OauthResourceServerConfigProfile
Viewing docs for HashiCorp Vault v7.14.1
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.OauthResourceServerConfigProfile

vault logo vault logo
Viewing docs for HashiCorp Vault v7.14.1
published on Tuesday, Oct 27, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages OAuth Resource Server Configuration profiles in Vault Enterprise. These profiles define how Vault validates JWT tokens from OAuth 2.0 resource servers, enabling JWT-based authentication for API requests.

    Important This resource is available only in Vault Enterprise and requires Vault 2.1.0 or later.

    Example Usage

    JWKS-Based Profile

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const example = new vault.OauthResourceServerConfigProfile("example", {
    profileName: "my-oauth-profile",
    issuerId: "https://auth.example.com",
    useJwks: true,
    jwksUri: "https://auth.example.com/.well-known/jwks.json",
    audiences: [
        "api.example.com",
        "vault.example.com",
    ],
});

    import pulumi
import pulumi_vault as vault

example = vault.OauthResourceServerConfigProfile("example",
    profile_name="my-oauth-profile",
    issuer_id="https://auth.example.com",
    use_jwks=True,
    jwks_uri="https://auth.example.com/.well-known/jwks.json",
    audiences=[
        "api.example.com",
        "vault.example.com",
    ])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vault.NewOauthResourceServerConfigProfile(ctx, "example", &vault.OauthResourceServerConfigProfileArgs{
			ProfileName: pulumi.String("my-oauth-profile"),
			IssuerId:    pulumi.String("https://auth.example.com"),
			UseJwks:     pulumi.Bool(true),
			JwksUri:     pulumi.String("https://auth.example.com/.well-known/jwks.json"),
			Audiences: pulumi.StringArray{
				pulumi.String("api.example.com"),
				pulumi.String("vault.example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var example = new Vault.OauthResourceServerConfigProfile("example", new()
    {
        ProfileName = "my-oauth-profile",
        IssuerId = "https://auth.example.com",
        UseJwks = true,
        JwksUri = "https://auth.example.com/.well-known/jwks.json",
        Audiences = new[]
        {
            "api.example.com",
            "vault.example.com",
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.OauthResourceServerConfigProfile;
import com.pulumi.vault.OauthResourceServerConfigProfileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new OauthResourceServerConfigProfile("example", OauthResourceServerConfigProfileArgs.builder()
            .profileName("my-oauth-profile")
            .issuerId("https://auth.example.com")
            .useJwks(true)
            .jwksUri("https://auth.example.com/.well-known/jwks.json")
            .audiences(            
                "api.example.com",
                "vault.example.com")
            .build());

    }
}

    resources:
  example:
    type: vault:OauthResourceServerConfigProfile
    properties:
      profileName: my-oauth-profile
      issuerId: https://auth.example.com
      useJwks: true
      jwksUri: https://auth.example.com/.well-known/jwks.json
      audiences:
        - api.example.com
        - vault.example.com

    terraform {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_oauth_resource_server_config_profile" "example" {
  lifecycle {
    create_before_destroy = true
  }
  profile_name = "my-oauth-profile"
  issuer_id    = "https://auth.example.com"
  use_jwks     = true
  jwks_uri     = "https://auth.example.com/.well-known/jwks.json"
  audiences    = ["api.example.com", "vault.example.com"]
}

    PEM-Based Profile with Static Keys

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const pemExample = new vault.OauthResourceServerConfigProfile("pem_example", {
    profileName: "my-pem-profile",
    issuerId: "https://auth.example.com",
    useJwks: false,
    publicKeys: [
        {
            keyId: "key-1",
            pem: `-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo
4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u
...
-----END PUBLIC KEY-----
`,
        },
        {
            keyId: "key-2",
            pem: `-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG
...
-----END PUBLIC KEY-----
`,
        },
    ],
});

    import pulumi
import pulumi_vault as vault

pem_example = vault.OauthResourceServerConfigProfile("pem_example",
    profile_name="my-pem-profile",
    issuer_id="https://auth.example.com",
    use_jwks=False,
    public_keys=[
        {
            "key_id": "key-1",
            "pem": """-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo
4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u
...
-----END PUBLIC KEY-----
""",
        },
        {
            "key_id": "key-2",
            "pem": """-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG
...
-----END PUBLIC KEY-----
""",
        },
    ])

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vault.NewOauthResourceServerConfigProfile(ctx, "pem_example", &vault.OauthResourceServerConfigProfileArgs{
			ProfileName: pulumi.String("my-pem-profile"),
			IssuerId:    pulumi.String("https://auth.example.com"),
			UseJwks:     pulumi.Bool(false),
			PublicKeys: vault.OauthResourceServerConfigProfilePublicKeyArray{
				&vault.OauthResourceServerConfigProfilePublicKeyArgs{
					KeyId: pulumi.String("key-1"),
					Pem: pulumi.String(`-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo
4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u
...
-----END PUBLIC KEY-----
`),
				},
				&vault.OauthResourceServerConfigProfilePublicKeyArgs{
					KeyId: pulumi.String("key-2"),
					Pem:   pulumi.String("-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG\n...\n-----END PUBLIC KEY-----\n"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var pemExample = new Vault.OauthResourceServerConfigProfile("pem_example", new()
    {
        ProfileName = "my-pem-profile",
        IssuerId = "https://auth.example.com",
        UseJwks = false,
        PublicKeys = new[]
        {
            new Vault.Inputs.OauthResourceServerConfigProfilePublicKeyArgs
            {
                KeyId = "key-1",
                Pem = @"-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo
4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u
...
-----END PUBLIC KEY-----
",
            },
            new Vault.Inputs.OauthResourceServerConfigProfilePublicKeyArgs
            {
                KeyId = "key-2",
                Pem = @"-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG
...
-----END PUBLIC KEY-----
",
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.OauthResourceServerConfigProfile;
import com.pulumi.vault.OauthResourceServerConfigProfileArgs;
import com.pulumi.vault.inputs.OauthResourceServerConfigProfilePublicKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var pemExample = new OauthResourceServerConfigProfile("pemExample", OauthResourceServerConfigProfileArgs.builder()
            .profileName("my-pem-profile")
            .issuerId("https://auth.example.com")
            .useJwks(false)
            .publicKeys(            
                OauthResourceServerConfigProfilePublicKeyArgs.builder()
                    .keyId("key-1")
                    .pem("""
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo
4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u
...
-----END PUBLIC KEY-----
                    """)
                    .build(),
                OauthResourceServerConfigProfilePublicKeyArgs.builder()
                    .keyId("key-2")
                    .pem("""
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG
...
-----END PUBLIC KEY-----
                    """)
                    .build())
            .build());

    }
}

    resources:
  pemExample:
    type: vault:OauthResourceServerConfigProfile
    name: pem_example
    properties:
      profileName: my-pem-profile
      issuerId: https://auth.example.com
      useJwks: false
      publicKeys:
        - keyId: key-1
          pem: |
            -----BEGIN PUBLIC KEY-----
            MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo
            4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u
            ...
            -----END PUBLIC KEY-----
        - keyId: key-2
          pem: |
            -----BEGIN PUBLIC KEY-----
            MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG
            ...
            -----END PUBLIC KEY-----

    terraform {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_oauth_resource_server_config_profile" "pem_example" {
  lifecycle {
    create_before_destroy = true
  }
  profile_name = "my-pem-profile"
  issuer_id    = "https://auth.example.com"
  use_jwks     = false
  public_keys {
    key_id = "key-1"
    pem    = <<-EOT
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo
4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u
...
-----END PUBLIC KEY-----
EOT

  }
  public_keys {
    key_id = "key-2"
    pem    = <<-EOT
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXxG8VqPvXxG8VqPvXxG
...
-----END PUBLIC KEY-----
EOT

  }
}

    Profile with RAR (Rich Authorization Requests) Support

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const rarOptional = new vault.OauthResourceServerConfigProfile("rar_optional", {
    profileName: "rar-optional-profile",
    issuerId: "https://auth.example.com",
    useJwks: true,
    jwksUri: "https://auth.example.com/.well-known/jwks.json",
    optionalAuthorizationDetails: true,
});
const rarMandatory = new vault.OauthResourceServerConfigProfile("rar_mandatory", {
    profileName: "rar-mandatory-profile",
    issuerId: "https://auth.example.com",
    useJwks: true,
    jwksUri: "https://auth.example.com/.well-known/jwks.json",
    optionalAuthorizationDetails: false,
});
const rarCustomClaim = new vault.OauthResourceServerConfigProfile("rar_custom_claim", {
    profileName: "rar-custom-claim-profile",
    issuerId: "https://auth.example.com",
    useJwks: true,
    jwksUri: "https://auth.example.com/.well-known/jwks.json",
    authorizationDetailsClaim: "rar_details",
});

    import pulumi
import pulumi_vault as vault

rar_optional = vault.OauthResourceServerConfigProfile("rar_optional",
    profile_name="rar-optional-profile",
    issuer_id="https://auth.example.com",
    use_jwks=True,
    jwks_uri="https://auth.example.com/.well-known/jwks.json",
    optional_authorization_details=True)
rar_mandatory = vault.OauthResourceServerConfigProfile("rar_mandatory",
    profile_name="rar-mandatory-profile",
    issuer_id="https://auth.example.com",
    use_jwks=True,
    jwks_uri="https://auth.example.com/.well-known/jwks.json",
    optional_authorization_details=False)
rar_custom_claim = vault.OauthResourceServerConfigProfile("rar_custom_claim",
    profile_name="rar-custom-claim-profile",
    issuer_id="https://auth.example.com",
    use_jwks=True,
    jwks_uri="https://auth.example.com/.well-known/jwks.json",
    authorization_details_claim="rar_details")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vault.NewOauthResourceServerConfigProfile(ctx, "rar_optional", &vault.OauthResourceServerConfigProfileArgs{
			ProfileName:                  pulumi.String("rar-optional-profile"),
			IssuerId:                     pulumi.String("https://auth.example.com"),
			UseJwks:                      pulumi.Bool(true),
			JwksUri:                      pulumi.String("https://auth.example.com/.well-known/jwks.json"),
			OptionalAuthorizationDetails: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewOauthResourceServerConfigProfile(ctx, "rar_mandatory", &vault.OauthResourceServerConfigProfileArgs{
			ProfileName:                  pulumi.String("rar-mandatory-profile"),
			IssuerId:                     pulumi.String("https://auth.example.com"),
			UseJwks:                      pulumi.Bool(true),
			JwksUri:                      pulumi.String("https://auth.example.com/.well-known/jwks.json"),
			OptionalAuthorizationDetails: pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewOauthResourceServerConfigProfile(ctx, "rar_custom_claim", &vault.OauthResourceServerConfigProfileArgs{
			ProfileName:               pulumi.String("rar-custom-claim-profile"),
			IssuerId:                  pulumi.String("https://auth.example.com"),
			UseJwks:                   pulumi.Bool(true),
			JwksUri:                   pulumi.String("https://auth.example.com/.well-known/jwks.json"),
			AuthorizationDetailsClaim: pulumi.String("rar_details"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var rarOptional = new Vault.OauthResourceServerConfigProfile("rar_optional", new()
    {
        ProfileName = "rar-optional-profile",
        IssuerId = "https://auth.example.com",
        UseJwks = true,
        JwksUri = "https://auth.example.com/.well-known/jwks.json",
        OptionalAuthorizationDetails = true,
    });

    var rarMandatory = new Vault.OauthResourceServerConfigProfile("rar_mandatory", new()
    {
        ProfileName = "rar-mandatory-profile",
        IssuerId = "https://auth.example.com",
        UseJwks = true,
        JwksUri = "https://auth.example.com/.well-known/jwks.json",
        OptionalAuthorizationDetails = false,
    });

    var rarCustomClaim = new Vault.OauthResourceServerConfigProfile("rar_custom_claim", new()
    {
        ProfileName = "rar-custom-claim-profile",
        IssuerId = "https://auth.example.com",
        UseJwks = true,
        JwksUri = "https://auth.example.com/.well-known/jwks.json",
        AuthorizationDetailsClaim = "rar_details",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.OauthResourceServerConfigProfile;
import com.pulumi.vault.OauthResourceServerConfigProfileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var rarOptional = new OauthResourceServerConfigProfile("rarOptional", OauthResourceServerConfigProfileArgs.builder()
            .profileName("rar-optional-profile")
            .issuerId("https://auth.example.com")
            .useJwks(true)
            .jwksUri("https://auth.example.com/.well-known/jwks.json")
            .optionalAuthorizationDetails(true)
            .build());

        var rarMandatory = new OauthResourceServerConfigProfile("rarMandatory", OauthResourceServerConfigProfileArgs.builder()
            .profileName("rar-mandatory-profile")
            .issuerId("https://auth.example.com")
            .useJwks(true)
            .jwksUri("https://auth.example.com/.well-known/jwks.json")
            .optionalAuthorizationDetails(false)
            .build());

        var rarCustomClaim = new OauthResourceServerConfigProfile("rarCustomClaim", OauthResourceServerConfigProfileArgs.builder()
            .profileName("rar-custom-claim-profile")
            .issuerId("https://auth.example.com")
            .useJwks(true)
            .jwksUri("https://auth.example.com/.well-known/jwks.json")
            .authorizationDetailsClaim("rar_details")
            .build());

    }
}

    resources:
  rarOptional:
    type: vault:OauthResourceServerConfigProfile
    name: rar_optional
    properties:
      profileName: rar-optional-profile
      issuerId: https://auth.example.com
      useJwks: true
      jwksUri: https://auth.example.com/.well-known/jwks.json
      optionalAuthorizationDetails: true
  rarMandatory:
    type: vault:OauthResourceServerConfigProfile
    name: rar_mandatory
    properties:
      profileName: rar-mandatory-profile
      issuerId: https://auth.example.com
      useJwks: true
      jwksUri: https://auth.example.com/.well-known/jwks.json
      optionalAuthorizationDetails: false
  rarCustomClaim:
    type: vault:OauthResourceServerConfigProfile
    name: rar_custom_claim
    properties:
      profileName: rar-custom-claim-profile
      issuerId: https://auth.example.com
      useJwks: true
      jwksUri: https://auth.example.com/.well-known/jwks.json
      authorizationDetailsClaim: rar_details

    terraform {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_oauth_resource_server_config_profile" "rar_optional" {
  lifecycle {
    create_before_destroy = true
  }
  profile_name                   = "rar-optional-profile"
  issuer_id                      = "https://auth.example.com"
  use_jwks                       = true
  jwks_uri                       = "https://auth.example.com/.well-known/jwks.json"
  optional_authorization_details = true
}
resource "vault_oauth_resource_server_config_profile" "rar_mandatory" {
  lifecycle {
    create_before_destroy = true
  }
  profile_name                   = "rar-mandatory-profile"
  issuer_id                      = "https://auth.example.com"
  use_jwks                       = true
  jwks_uri                       = "https://auth.example.com/.well-known/jwks.json"
  optional_authorization_details = false
}
resource "vault_oauth_resource_server_config_profile" "rar_custom_claim" {
  lifecycle {
    create_before_destroy = true
  }
  profile_name                = "rar-custom-claim-profile"
  issuer_id                   = "https://auth.example.com"
  use_jwks                    = true
  jwks_uri                    = "https://auth.example.com/.well-known/jwks.json"
  authorization_details_claim = "rar_details"
}

    Profile in a Namespace

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const app = new vault.Namespace("app", {path: "application"});
const namespaced = new vault.OauthResourceServerConfigProfile("namespaced", {
    namespace: app.path,
    profileName: "app-oauth-profile",
    issuerId: "https://auth.example.com",
    useJwks: true,
    jwksUri: "https://auth.example.com/.well-known/jwks.json",
});

    import pulumi
import pulumi_vault as vault

app = vault.Namespace("app", path="application")
namespaced = vault.OauthResourceServerConfigProfile("namespaced",
    namespace=app.path,
    profile_name="app-oauth-profile",
    issuer_id="https://auth.example.com",
    use_jwks=True,
    jwks_uri="https://auth.example.com/.well-known/jwks.json")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		app, err := vault.NewNamespace(ctx, "app", &vault.NamespaceArgs{
			Path: pulumi.String("application"),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewOauthResourceServerConfigProfile(ctx, "namespaced", &vault.OauthResourceServerConfigProfileArgs{
			Namespace:   app.Path,
			ProfileName: pulumi.String("app-oauth-profile"),
			IssuerId:    pulumi.String("https://auth.example.com"),
			UseJwks:     pulumi.Bool(true),
			JwksUri:     pulumi.String("https://auth.example.com/.well-known/jwks.json"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var app = new Vault.Namespace("app", new()
    {
        Path = "application",
    });

    var namespaced = new Vault.OauthResourceServerConfigProfile("namespaced", new()
    {
        Namespace = app.Path,
        ProfileName = "app-oauth-profile",
        IssuerId = "https://auth.example.com",
        UseJwks = true,
        JwksUri = "https://auth.example.com/.well-known/jwks.json",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Namespace;
import com.pulumi.vault.NamespaceArgs;
import com.pulumi.vault.OauthResourceServerConfigProfile;
import com.pulumi.vault.OauthResourceServerConfigProfileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var app = new Namespace("app", NamespaceArgs.builder()
            .path("application")
            .build());

        var namespaced = new OauthResourceServerConfigProfile("namespaced", OauthResourceServerConfigProfileArgs.builder()
            .namespace(app.path())
            .profileName("app-oauth-profile")
            .issuerId("https://auth.example.com")
            .useJwks(true)
            .jwksUri("https://auth.example.com/.well-known/jwks.json")
            .build());

    }
}

    resources:
  app:
    type: vault:Namespace
    properties:
      path: application
  namespaced:
    type: vault:OauthResourceServerConfigProfile
    properties:
      namespace: ${app.path}
      profileName: app-oauth-profile
      issuerId: https://auth.example.com
      useJwks: true
      jwksUri: https://auth.example.com/.well-known/jwks.json

    terraform {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_namespace" "app" {
  lifecycle {
    create_before_destroy = true
  }
  path = "application"
}
resource "vault_oauth_resource_server_config_profile" "namespaced" {
  lifecycle {
    create_before_destroy = true
  }
  namespace    = vault_namespace.app.path
  profile_name = "app-oauth-profile"
  issuer_id    = "https://auth.example.com"
  use_jwks     = true
  jwks_uri     = "https://auth.example.com/.well-known/jwks.json"
}

    Disabled Profile

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const disabled = new vault.OauthResourceServerConfigProfile("disabled", {
    profileName: "disabled-profile",
    issuerId: "https://auth.example.com",
    useJwks: true,
    jwksUri: "https://auth.example.com/.well-known/jwks.json",
    enabled: false,
});

    import pulumi
import pulumi_vault as vault

disabled = vault.OauthResourceServerConfigProfile("disabled",
    profile_name="disabled-profile",
    issuer_id="https://auth.example.com",
    use_jwks=True,
    jwks_uri="https://auth.example.com/.well-known/jwks.json",
    enabled=False)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vault.NewOauthResourceServerConfigProfile(ctx, "disabled", &vault.OauthResourceServerConfigProfileArgs{
			ProfileName: pulumi.String("disabled-profile"),
			IssuerId:    pulumi.String("https://auth.example.com"),
			UseJwks:     pulumi.Bool(true),
			JwksUri:     pulumi.String("https://auth.example.com/.well-known/jwks.json"),
			Enabled:     pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var disabled = new Vault.OauthResourceServerConfigProfile("disabled", new()
    {
        ProfileName = "disabled-profile",
        IssuerId = "https://auth.example.com",
        UseJwks = true,
        JwksUri = "https://auth.example.com/.well-known/jwks.json",
        Enabled = false,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.OauthResourceServerConfigProfile;
import com.pulumi.vault.OauthResourceServerConfigProfileArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var disabled = new OauthResourceServerConfigProfile("disabled", OauthResourceServerConfigProfileArgs.builder()
            .profileName("disabled-profile")
            .issuerId("https://auth.example.com")
            .useJwks(true)
            .jwksUri("https://auth.example.com/.well-known/jwks.json")
            .enabled(false)
            .build());

    }
}

    resources:
  disabled:
    type: vault:OauthResourceServerConfigProfile
    properties:
      profileName: disabled-profile
      issuerId: https://auth.example.com
      useJwks: true
      jwksUri: https://auth.example.com/.well-known/jwks.json
      enabled: false

    terraform {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_oauth_resource_server_config_profile" "disabled" {
  lifecycle {
    create_before_destroy = true
  }
  profile_name = "disabled-profile"
  issuer_id    = "https://auth.example.com"
  use_jwks     = true
  jwks_uri     = "https://auth.example.com/.well-known/jwks.json"
  enabled      = false
}

    Notes

    • Mutual Exclusivity: The useJwks flag determines which configuration mode is active:

      • When use_jwks=true: You must provide jwksUri and cannot provide publicKeys
      • When use_jwks=false: You must provide publicKeys and cannot provide jwksUri

    • Issuer Uniqueness: Each issuer ID must be unique within a locality (globally replicated or local to the cluster) and a namespace. You cannot have multiple profiles with the same issuer ID and locality in the same namespace.

    • Field Immutability: The profileName, issuerId, uniqueIdClaim, and local cannot be changed after creation. Changing these fields will force a new resource to be created.

    • Key ID Uniqueness: Within a profile, all key IDs must be unique. This applies to both JWKS keys and static PEM keys.

    • JWKS Caching: When using JWKS, Vault caches the public keys and refreshes them periodically. Unknown key IDs trigger a rate-limited refresh to prevent DoS attacks.

    • Algorithm Validation: The JWT’s signing algorithm must be in the supportedAlgorithms list. This provides defense against algorithm confusion attacks.

    • Audience Validation: If audiences is specified, the JWT must contain at least one matching audience in its aud claim. If not specified, audience validation is skipped.

    • Clock Skew: Use clockSkewLeeway to handle clock differences between systems. A value of 30-60 seconds is typically sufficient for most environments.

    • Enterprise Feature: OAuth Resource Server Configuration is available only in Vault Enterprise. Attempting to use this resource with Vault Community Edition will result in an error.

    • Version Requirement: This resource requires Vault 2.1.0 or later.

    Security Considerations

    • HTTPS for JWKS: Always use HTTPS for jwksUri to prevent man-in-the-middle attacks.

    • CA Certificate Validation: When using custom CA certificates, ensure they are properly validated and from trusted sources.

    • Key Rotation: When rotating keys, ensure the new keys are published to the JWKS endpoint before revoking old keys to prevent authentication failures.

    • Disabled Profiles: Disabled profiles are completely ignored during JWT validation. Use this feature carefully in production environments.

    • Algorithm Selection: Limit supportedAlgorithms to only those algorithms your authorization server uses. This reduces the attack surface.

    Create OauthResourceServerConfigProfile Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new OauthResourceServerConfigProfile(name: string, args: OauthResourceServerConfigProfileArgs, opts?: CustomResourceOptions);
    @overload
def OauthResourceServerConfigProfile(resource_name: str,
                                     args: OauthResourceServerConfigProfileArgs,
                                     opts: Optional[ResourceOptions] = None)

@overload
def OauthResourceServerConfigProfile(resource_name: str,
                                     opts: Optional[ResourceOptions] = None,
                                     issuer_id: Optional[str] = None,
                                     profile_name: Optional[str] = None,
                                     jwt_type: Optional[str] = None,
                                     no_default_policy: Optional[bool] = None,
                                     enabled: Optional[bool] = None,
                                     authorization_details_claim: Optional[str] = None,
                                     jwks_ca_pem: Optional[str] = None,
                                     jwks_uri: Optional[str] = None,
                                     actor_claim: Optional[str] = None,
                                     local: Optional[bool] = None,
                                     namespace: Optional[str] = None,
                                     clock_skew_leeway: Optional[int] = None,
                                     optional_authorization_details: Optional[bool] = None,
                                     audiences: Optional[Sequence[str]] = None,
                                     public_keys: Optional[Sequence[OauthResourceServerConfigProfilePublicKeyArgs]] = None,
                                     supported_algorithms: Optional[Sequence[str]] = None,
                                     unique_id_claim: Optional[str] = None,
                                     use_jwks: Optional[bool] = None,
                                     user_claim: Optional[str] = None)
    func NewOauthResourceServerConfigProfile(ctx *Context, name string, args OauthResourceServerConfigProfileArgs, opts ...ResourceOption) (*OauthResourceServerConfigProfile, error)
    public OauthResourceServerConfigProfile(string name, OauthResourceServerConfigProfileArgs args, CustomResourceOptions? opts = null)
    public OauthResourceServerConfigProfile(String name, OauthResourceServerConfigProfileArgs args)
public OauthResourceServerConfigProfile(String name, OauthResourceServerConfigProfileArgs args, CustomResourceOptions options)

    type: vault:OauthResourceServerConfigProfile
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_oauth_resource_server_config_profile" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args OauthResourceServerConfigProfileArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args OauthResourceServerConfigProfileArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args OauthResourceServerConfigProfileArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args OauthResourceServerConfigProfileArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args OauthResourceServerConfigProfileArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var oauthResourceServerConfigProfileResource = new Vault.OauthResourceServerConfigProfile("oauthResourceServerConfigProfileResource", new()
{
    IssuerId = "string",
    ProfileName = "string",
    JwtType = "string",
    NoDefaultPolicy = false,
    Enabled = false,
    AuthorizationDetailsClaim = "string",
    JwksCaPem = "string",
    JwksUri = "string",
    ActorClaim = "string",
    Local = false,
    Namespace = "string",
    ClockSkewLeeway = 0,
    OptionalAuthorizationDetails = false,
    Audiences = new[]
    {
        "string",
    },
    PublicKeys = new[]
    {
        new Vault.Inputs.OauthResourceServerConfigProfilePublicKeyArgs
        {
            KeyId = "string",
            Pem = "string",
        },
    },
    SupportedAlgorithms = new[]
    {
        "string",
    },
    UniqueIdClaim = "string",
    UseJwks = false,
    UserClaim = "string",
});

    example, err := vault.NewOauthResourceServerConfigProfile(ctx, "oauthResourceServerConfigProfileResource", &vault.OauthResourceServerConfigProfileArgs{
	IssuerId:                     pulumi.String("string"),
	ProfileName:                  pulumi.String("string"),
	JwtType:                      pulumi.String("string"),
	NoDefaultPolicy:              pulumi.Bool(false),
	Enabled:                      pulumi.Bool(false),
	AuthorizationDetailsClaim:    pulumi.String("string"),
	JwksCaPem:                    pulumi.String("string"),
	JwksUri:                      pulumi.String("string"),
	ActorClaim:                   pulumi.String("string"),
	Local:                        pulumi.Bool(false),
	Namespace:                    pulumi.String("string"),
	ClockSkewLeeway:              pulumi.Int(0),
	OptionalAuthorizationDetails: pulumi.Bool(false),
	Audiences: pulumi.StringArray{
		pulumi.String("string"),
	},
	PublicKeys: vault.OauthResourceServerConfigProfilePublicKeyArray{
		&vault.OauthResourceServerConfigProfilePublicKeyArgs{
			KeyId: pulumi.String("string"),
			Pem:   pulumi.String("string"),
		},
	},
	SupportedAlgorithms: pulumi.StringArray{
		pulumi.String("string"),
	},
	UniqueIdClaim: pulumi.String("string"),
	UseJwks:       pulumi.Bool(false),
	UserClaim:     pulumi.String("string"),
})

    resource "vault_oauth_resource_server_config_profile" "oauthResourceServerConfigProfileResource" {
  lifecycle {
    create_before_destroy = true
  }
  issuer_id                      = "string"
  profile_name                   = "string"
  jwt_type                       = "string"
  no_default_policy              = false
  enabled                        = false
  authorization_details_claim    = "string"
  jwks_ca_pem                    = "string"
  jwks_uri                       = "string"
  actor_claim                    = "string"
  local                          = false
  namespace                      = "string"
  clock_skew_leeway              = 0
  optional_authorization_details = false
  audiences                      = ["string"]
  public_keys {
    key_id = "string"
    pem    = "string"
  }
  supported_algorithms = ["string"]
  unique_id_claim      = "string"
  use_jwks             = false
  user_claim           = "string"
}

    var oauthResourceServerConfigProfileResource = new OauthResourceServerConfigProfile("oauthResourceServerConfigProfileResource", OauthResourceServerConfigProfileArgs.builder()
    .issuerId("string")
    .profileName("string")
    .jwtType("string")
    .noDefaultPolicy(false)
    .enabled(false)
    .authorizationDetailsClaim("string")
    .jwksCaPem("string")
    .jwksUri("string")
    .actorClaim("string")
    .local(false)
    .namespace("string")
    .clockSkewLeeway(0)
    .optionalAuthorizationDetails(false)
    .audiences("string")
    .publicKeys(OauthResourceServerConfigProfilePublicKeyArgs.builder()
        .keyId("string")
        .pem("string")
        .build())
    .supportedAlgorithms("string")
    .uniqueIdClaim("string")
    .useJwks(false)
    .userClaim("string")
    .build());

    oauth_resource_server_config_profile_resource = vault.OauthResourceServerConfigProfile("oauthResourceServerConfigProfileResource",
    issuer_id="string",
    profile_name="string",
    jwt_type="string",
    no_default_policy=False,
    enabled=False,
    authorization_details_claim="string",
    jwks_ca_pem="string",
    jwks_uri="string",
    actor_claim="string",
    local=False,
    namespace="string",
    clock_skew_leeway=0,
    optional_authorization_details=False,
    audiences=["string"],
    public_keys=[{
        "key_id": "string",
        "pem": "string",
    }],
    supported_algorithms=["string"],
    unique_id_claim="string",
    use_jwks=False,
    user_claim="string")

    const oauthResourceServerConfigProfileResource = new vault.OauthResourceServerConfigProfile("oauthResourceServerConfigProfileResource", {
    issuerId: "string",
    profileName: "string",
    jwtType: "string",
    noDefaultPolicy: false,
    enabled: false,
    authorizationDetailsClaim: "string",
    jwksCaPem: "string",
    jwksUri: "string",
    actorClaim: "string",
    local: false,
    namespace: "string",
    clockSkewLeeway: 0,
    optionalAuthorizationDetails: false,
    audiences: ["string"],
    publicKeys: [{
        keyId: "string",
        pem: "string",
    }],
    supportedAlgorithms: ["string"],
    uniqueIdClaim: "string",
    useJwks: false,
    userClaim: "string",
});

    type: vault:OauthResourceServerConfigProfile
properties:
    actorClaim: string
    audiences:
        - string
    authorizationDetailsClaim: string
    clockSkewLeeway: 0
    enabled: false
    issuerId: string
    jwksCaPem: string
    jwksUri: string
    jwtType: string
    local: false
    namespace: string
    noDefaultPolicy: false
    optionalAuthorizationDetails: false
    profileName: string
    publicKeys:
        - keyId: string
          pem: string
    supportedAlgorithms:
        - string
    uniqueIdClaim: string
    useJwks: false
    userClaim: string

    OauthResourceServerConfigProfile Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The OauthResourceServerConfigProfile resource accepts the following input properties:

    IssuerId string
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    ProfileName string
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    ActorClaim string
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    Audiences List<string>
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    AuthorizationDetailsClaim string
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    ClockSkewLeeway int
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    Enabled bool
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    JwksCaPem string
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    JwksUri string
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    JwtType string
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    Local bool
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    NoDefaultPolicy bool
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    OptionalAuthorizationDetails bool
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    PublicKeys List<OauthResourceServerConfigProfilePublicKey>
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    SupportedAlgorithms List<string>
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    UniqueIdClaim string
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    UseJwks bool
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    UserClaim string
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    IssuerId string
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    ProfileName string
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    ActorClaim string
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    Audiences []string
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    AuthorizationDetailsClaim string
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    ClockSkewLeeway int
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    Enabled bool
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    JwksCaPem string
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    JwksUri string
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    JwtType string
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    Local bool
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    NoDefaultPolicy bool
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    OptionalAuthorizationDetails bool
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    PublicKeys []OauthResourceServerConfigProfilePublicKeyArgs
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    SupportedAlgorithms []string
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    UniqueIdClaim string
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    UseJwks bool
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    UserClaim string
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    issuer_id string
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    profile_name string
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    actor_claim string
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    audiences list(string)
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    authorization_details_claim string
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    clock_skew_leeway number
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    enabled bool
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    jwks_ca_pem string
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    jwks_uri string
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    jwt_type string
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    local bool
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    no_default_policy bool
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    optional_authorization_details bool
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    public_keys list(object)
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    supported_algorithms list(string)
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    unique_id_claim string
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    use_jwks bool
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    user_claim string
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    issuerId String
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    profileName String
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    actorClaim String
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    audiences List<String>
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    authorizationDetailsClaim String
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    clockSkewLeeway Integer
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    enabled Boolean
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    jwksCaPem String
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    jwksUri String
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    jwtType String
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    local Boolean
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    noDefaultPolicy Boolean
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    optionalAuthorizationDetails Boolean
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    publicKeys List<OauthResourceServerConfigProfilePublicKey>
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    supportedAlgorithms List<String>
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    uniqueIdClaim String
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    useJwks Boolean
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    userClaim String
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    issuerId string
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    profileName string
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    actorClaim string
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    audiences string[]
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    authorizationDetailsClaim string
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    clockSkewLeeway number
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    enabled boolean
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    jwksCaPem string
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    jwksUri string
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    jwtType string
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    local boolean
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    noDefaultPolicy boolean
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    optionalAuthorizationDetails boolean
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    publicKeys OauthResourceServerConfigProfilePublicKey[]
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    supportedAlgorithms string[]
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    uniqueIdClaim string
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    useJwks boolean
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    userClaim string
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    issuer_id str
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    profile_name str
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    actor_claim str
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    audiences Sequence[str]
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    authorization_details_claim str
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    clock_skew_leeway int
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    enabled bool
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    jwks_ca_pem str
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    jwks_uri str
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    jwt_type str
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    local bool
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    no_default_policy bool
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    optional_authorization_details bool
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    public_keys Sequence[OauthResourceServerConfigProfilePublicKeyArgs]
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    supported_algorithms Sequence[str]
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    unique_id_claim str
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    use_jwks bool
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    user_claim str
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    issuerId String
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    profileName String
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    actorClaim String
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    audiences List<String>
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    authorizationDetailsClaim String
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    clockSkewLeeway Number
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    enabled Boolean
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    jwksCaPem String
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    jwksUri String
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    jwtType String
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    local Boolean
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    noDefaultPolicy Boolean
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    optionalAuthorizationDetails Boolean
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    publicKeys List<Property Map>
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    supportedAlgorithms List<String>
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    uniqueIdClaim String
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    useJwks Boolean
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    userClaim String
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the OauthResourceServerConfigProfile resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing OauthResourceServerConfigProfile Resource

    Get an existing OauthResourceServerConfigProfile resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: OauthResourceServerConfigProfileState, opts?: CustomResourceOptions): OauthResourceServerConfigProfile
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        actor_claim: Optional[str] = None,
        audiences: Optional[Sequence[str]] = None,
        authorization_details_claim: Optional[str] = None,
        clock_skew_leeway: Optional[int] = None,
        enabled: Optional[bool] = None,
        issuer_id: Optional[str] = None,
        jwks_ca_pem: Optional[str] = None,
        jwks_uri: Optional[str] = None,
        jwt_type: Optional[str] = None,
        local: Optional[bool] = None,
        namespace: Optional[str] = None,
        no_default_policy: Optional[bool] = None,
        optional_authorization_details: Optional[bool] = None,
        profile_name: Optional[str] = None,
        public_keys: Optional[Sequence[OauthResourceServerConfigProfilePublicKeyArgs]] = None,
        supported_algorithms: Optional[Sequence[str]] = None,
        unique_id_claim: Optional[str] = None,
        use_jwks: Optional[bool] = None,
        user_claim: Optional[str] = None) -> OauthResourceServerConfigProfile
    func GetOauthResourceServerConfigProfile(ctx *Context, name string, id IDInput, state *OauthResourceServerConfigProfileState, opts ...ResourceOption) (*OauthResourceServerConfigProfile, error)
    public static OauthResourceServerConfigProfile Get(string name, Input<string> id, OauthResourceServerConfigProfileState? state, CustomResourceOptions? opts = null)
    public static OauthResourceServerConfigProfile get(String name, Output<String> id, OauthResourceServerConfigProfileState state, CustomResourceOptions options)
    resources:  _:    type: vault:OauthResourceServerConfigProfile    get:      id: ${id}
    import {
  to = vault_oauth_resource_server_config_profile.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ActorClaim string
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    Audiences List<string>
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    AuthorizationDetailsClaim string
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    ClockSkewLeeway int
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    Enabled bool
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    IssuerId string
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    JwksCaPem string
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    JwksUri string
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    JwtType string
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    Local bool
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    NoDefaultPolicy bool
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    OptionalAuthorizationDetails bool
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    ProfileName string
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    PublicKeys List<OauthResourceServerConfigProfilePublicKey>
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    SupportedAlgorithms List<string>
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    UniqueIdClaim string
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    UseJwks bool
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    UserClaim string
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    ActorClaim string
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    Audiences []string
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    AuthorizationDetailsClaim string
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    ClockSkewLeeway int
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    Enabled bool
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    IssuerId string
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    JwksCaPem string
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    JwksUri string
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    JwtType string
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    Local bool
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    NoDefaultPolicy bool
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    OptionalAuthorizationDetails bool
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    ProfileName string
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    PublicKeys []OauthResourceServerConfigProfilePublicKeyArgs
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    SupportedAlgorithms []string
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    UniqueIdClaim string
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    UseJwks bool
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    UserClaim string
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    actor_claim string
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    audiences list(string)
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    authorization_details_claim string
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    clock_skew_leeway number
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    enabled bool
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    issuer_id string
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    jwks_ca_pem string
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    jwks_uri string
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    jwt_type string
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    local bool
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    no_default_policy bool
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    optional_authorization_details bool
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    profile_name string
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    public_keys list(object)
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    supported_algorithms list(string)
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    unique_id_claim string
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    use_jwks bool
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    user_claim string
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    actorClaim String
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    audiences List<String>
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    authorizationDetailsClaim String
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    clockSkewLeeway Integer
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    enabled Boolean
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    issuerId String
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    jwksCaPem String
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    jwksUri String
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    jwtType String
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    local Boolean
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    noDefaultPolicy Boolean
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    optionalAuthorizationDetails Boolean
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    profileName String
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    publicKeys List<OauthResourceServerConfigProfilePublicKey>
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    supportedAlgorithms List<String>
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    uniqueIdClaim String
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    useJwks Boolean
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    userClaim String
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    actorClaim string
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    audiences string[]
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    authorizationDetailsClaim string
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    clockSkewLeeway number
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    enabled boolean
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    issuerId string
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    jwksCaPem string
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    jwksUri string
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    jwtType string
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    local boolean
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    noDefaultPolicy boolean
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    optionalAuthorizationDetails boolean
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    profileName string
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    publicKeys OauthResourceServerConfigProfilePublicKey[]
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    supportedAlgorithms string[]
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    uniqueIdClaim string
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    useJwks boolean
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    userClaim string
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    actor_claim str
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    audiences Sequence[str]
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    authorization_details_claim str
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    clock_skew_leeway int
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    enabled bool
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    issuer_id str
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    jwks_ca_pem str
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    jwks_uri str
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    jwt_type str
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    local bool
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    no_default_policy bool
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    optional_authorization_details bool
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    profile_name str
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    public_keys Sequence[OauthResourceServerConfigProfilePublicKeyArgs]
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    supported_algorithms Sequence[str]
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    unique_id_claim str
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    use_jwks bool
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    user_claim str
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.
    actorClaim String
    The JWT claim to use as the actor identifier for delegation and chained-token scenarios (RFC 8693 act claim). Requires Vault 2.2.0 or later.
    audiences List<String>
    List of allowed audiences (aud claim) to validate in JWTs. If specified, the JWT must contain at least one of these audiences in its aud claim.
    authorizationDetailsClaim String
    The string name of the JWT claim that contains RAR (Rich Authorization Requests) authorization details. Requires Vault 2.2.0 or later when set. If omitted, Vault 2.2.0 and later use authorizationDetails.
    clockSkewLeeway Number
    Leeway for clock skew in seconds when validating time-based claims (exp, iat, nbf). Defaults to 0. Use this to account for clock differences between systems.
    enabled Boolean
    Whether this profile is enabled for JWT validation. Disabled profiles are ignored during JWT authentication. Defaults to true.
    issuerId String
    The issuer ID (iss claim) to validate against in incoming JWTs. This should match the issuer claim in the JWT tokens. Changing this will force a new resource to be created.
    jwksCaPem String
    CA certificate (PEM format) for JWKS URI TLS validation. Use this when the JWKS URI uses a custom CA certificate.
    jwksUri String
    The JWKS URI to fetch public keys from. Required when use_jwks=true. This should be the URL where the authorization server publishes its public keys in JWKS format.
    jwtType String
    The JWT type: accessToken or transactionToken. Defaults to accessToken.
    local Boolean
    When false, the profile is written to replicated storage and propagated to all performance secondaries. When set to true, the profile remains local to the current cluster and is not replicated. The local field cannot be updated on a profile. Requires Vault 2.2.0 or later.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    noDefaultPolicy Boolean
    If true, JWT-authenticated tokens omit the default policy unless added elsewhere. Defaults to false.
    optionalAuthorizationDetails Boolean
    When false, RAR (Rich Authorization Requests) is mandatory and authorizationDetails must be present in the token. When set to true, authorizationDetails in the JWT token are optional. Defaults to false. Requires Vault 2.0.3 or later.
    profileName String
    The name of the OAuth Resource Server Configuration profile. Must be unique within the namespace. Changing this will force a new resource to be created.
    publicKeys List<Property Map>
    List of static public keys with keyId and pem fields. Required when use_jwks=false. Each public key must have:
    supportedAlgorithms List<String>
    List of supported signing algorithms (e.g., RS256, ES256). Defaults to all supported algorithms: ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"]. Valid values are:

    • RS256, RS384, RS512 - RSA with SHA-256/384/512
    • ES256, ES384, ES512 - ECDSA with SHA-256/384/512
    • PS256, PS384, PS512 - RSA-PSS with SHA-256/384/512
    uniqueIdClaim String
    The JWT claim to use as the unique identifier for the token. If unset, Vault uses the jti claim. The uniqueIdClaim field cannot be updated on a profile; changing it forces a new resource. Requires Vault 2.2.0 or later.
    useJwks Boolean
    If true, use JWKS URI for key validation; if false, use static public keys. Defaults to true. When set to true, jwksUri is required. When set to false, publicKeys is required.
    userClaim String
    The claim to use as the user identifier. Defaults to sub. This determines which JWT claim is used to identify the user.

    Supporting Types

    OauthResourceServerConfigProfilePublicKey, OauthResourceServerConfigProfilePublicKeyArgs

    KeyId string
    The key ID (kid) for this public key. Must be unique within the profile.
    Pem string
    The PEM-encoded public key.
    KeyId string
    The key ID (kid) for this public key. Must be unique within the profile.
    Pem string
    The PEM-encoded public key.
    key_id string
    The key ID (kid) for this public key. Must be unique within the profile.
    pem string
    The PEM-encoded public key.
    keyId String
    The key ID (kid) for this public key. Must be unique within the profile.
    pem String
    The PEM-encoded public key.
    keyId string
    The key ID (kid) for this public key. Must be unique within the profile.
    pem string
    The PEM-encoded public key.
    key_id str
    The key ID (kid) for this public key. Must be unique within the profile.
    pem str
    The PEM-encoded public key.
    keyId String
    The key ID (kid) for this public key. Must be unique within the profile.
    pem String
    The PEM-encoded public key.

    Import

    You can import OAuth Resource Server Configuration profiles using their profileName, e.g.

    $ pulumi import vault:index/oauthResourceServerConfigProfile:OauthResourceServerConfigProfile example my-oauth-profile

    The import string does not encode the namespace. To import a profile from a namespace, set the TERRAFORM_VAULT_NAMESPACE_IMPORT environment variable:

    $ TERRAFORM_VAULT_NAMESPACE_IMPORT=application terraform import vault_oauth_resource_server_config_profile.example my-oauth-profile

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.14.1
    published on Tuesday, Oct 27, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial