Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. ScimClient
Viewing docs for HashiCorp Vault v7.14.0
published on Thursday, Oct 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.ScimClient

vault logo vault logo
Viewing docs for HashiCorp Vault v7.14.0
published on Thursday, Oct 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages a SCIM client in Vault. A SCIM client lets an external identity provider (such as Okta, Entra ID or SailPoint) provision entities, aliases and groups in Vault through the SCIM 2.0 protocol. Requires Vault Enterprise 2.2.0 or later. Available only for Vault Enterprise.

    For more information, see the Vault SCIM API documentation.

    Important Vault requires the SCIM feature to be activated with the enable-scim activation flag before SCIM clients can be used. Activation cannot be undone. See the Vault documentation linked above.

    Important Creating a client first reads its path to make sure the name is not already in use, so the token used by Terraform needs read capability on identity/scim/client/* as well as create and update.

    Example Usage

    Minimal

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const scimOperator = new vault.identity.Entity("scim_operator", {name: "scim-operator"});
const okta = new vault.ScimClient("okta", {
    clientName: "okta-prod",
    accessGrantPrincipal: scimOperator.id,
});

    import pulumi
import pulumi_vault as vault

scim_operator = vault.identity.Entity("scim_operator", name="scim-operator")
okta = vault.ScimClient("okta",
    client_name="okta-prod",
    access_grant_principal=scim_operator.id)

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		scimOperator, err := identity.NewEntity(ctx, "scim_operator", &identity.EntityArgs{
			Name: pulumi.String("scim-operator"),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewScimClient(ctx, "okta", &vault.ScimClientArgs{
			ClientName:           pulumi.String("okta-prod"),
			AccessGrantPrincipal: scimOperator.ID().ToIDOutput().ToStringOutput(),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var scimOperator = new Vault.Identity.Entity("scim_operator", new()
    {
        Name = "scim-operator",
    });

    var okta = new Vault.ScimClient("okta", new()
    {
        ClientName = "okta-prod",
        AccessGrantPrincipal = scimOperator.Id,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.identity.Entity;
import com.pulumi.vault.identity.EntityArgs;
import com.pulumi.vault.ScimClient;
import com.pulumi.vault.ScimClientArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var scimOperator = new Entity("scimOperator", EntityArgs.builder()
            .name("scim-operator")
            .build());

        var okta = new ScimClient("okta", ScimClientArgs.builder()
            .clientName("okta-prod")
            .accessGrantPrincipal(scimOperator.id())
            .build());

    }
}

    resources:
  scimOperator:
    type: vault:identity:Entity
    name: scim_operator
    properties:
      name: scim-operator
  okta:
    type: vault:ScimClient
    properties:
      clientName: okta-prod
      accessGrantPrincipal: ${scimOperator.id}

    terraform {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_identity_entity" "scim_operator" {
  lifecycle {
    create_before_destroy = true
  }
  name = "scim-operator"
}
resource "vault_scim_client" "okta" {
  lifecycle {
    create_before_destroy = true
  }
  client_name            = "okta-prod"
  access_grant_principal = vault_identity_entity.scim_operator.id
}

    With all optional arguments

    import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const userpass = new vault.AuthBackend("userpass", {
    type: "userpass",
    path: "userpass-scim",
});
const extra = new vault.AuthBackend("extra", {
    type: "userpass",
    path: "userpass-scim-extra",
});
const scimOperator = new vault.identity.Entity("scim_operator", {name: "scim-operator"});
const okta = new vault.ScimClient("okta", {
    clientName: "okta-prod",
    accessGrantPrincipal: scimOperator.id,
    aliasMountAccessor: userpass.accessor,
    allowedExtraAliasMountAccessors: [extra.accessor],
    defaultSchemaVersion: "2.2",
    allowUserAdoption: true,
    allowGroupAdoption: true,
    maxActiveTokens: 5,
    maxTokenTtl: 3600,
    deletionPolicy: "orphan_child_resources",
});

    import pulumi
import pulumi_vault as vault

userpass = vault.AuthBackend("userpass",
    type="userpass",
    path="userpass-scim")
extra = vault.AuthBackend("extra",
    type="userpass",
    path="userpass-scim-extra")
scim_operator = vault.identity.Entity("scim_operator", name="scim-operator")
okta = vault.ScimClient("okta",
    client_name="okta-prod",
    access_grant_principal=scim_operator.id,
    alias_mount_accessor=userpass.accessor,
    allowed_extra_alias_mount_accessors=[extra.accessor],
    default_schema_version="2.2",
    allow_user_adoption=True,
    allow_group_adoption=True,
    max_active_tokens=5,
    max_token_ttl=3600,
    deletion_policy="orphan_child_resources")

    package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault/identity"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		userpass, err := vault.NewAuthBackend(ctx, "userpass", &vault.AuthBackendArgs{
			Type: pulumi.String("userpass"),
			Path: pulumi.String("userpass-scim"),
		})
		if err != nil {
			return err
		}
		extra, err := vault.NewAuthBackend(ctx, "extra", &vault.AuthBackendArgs{
			Type: pulumi.String("userpass"),
			Path: pulumi.String("userpass-scim-extra"),
		})
		if err != nil {
			return err
		}
		scimOperator, err := identity.NewEntity(ctx, "scim_operator", &identity.EntityArgs{
			Name: pulumi.String("scim-operator"),
		})
		if err != nil {
			return err
		}
		_, err = vault.NewScimClient(ctx, "okta", &vault.ScimClientArgs{
			ClientName:           pulumi.String("okta-prod"),
			AccessGrantPrincipal: scimOperator.ID().ToIDOutput().ToStringOutput(),
			AliasMountAccessor:   userpass.Accessor,
			AllowedExtraAliasMountAccessors: pulumi.StringArray{
				extra.Accessor,
			},
			DefaultSchemaVersion: pulumi.String("2.2"),
			AllowUserAdoption:    pulumi.Bool(true),
			AllowGroupAdoption:   pulumi.Bool(true),
			MaxActiveTokens:      pulumi.Int(5),
			MaxTokenTtl:          pulumi.Int(3600),
			DeletionPolicy:       pulumi.String("orphan_child_resources"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var userpass = new Vault.AuthBackend("userpass", new()
    {
        Type = "userpass",
        Path = "userpass-scim",
    });

    var extra = new Vault.AuthBackend("extra", new()
    {
        Type = "userpass",
        Path = "userpass-scim-extra",
    });

    var scimOperator = new Vault.Identity.Entity("scim_operator", new()
    {
        Name = "scim-operator",
    });

    var okta = new Vault.ScimClient("okta", new()
    {
        ClientName = "okta-prod",
        AccessGrantPrincipal = scimOperator.Id,
        AliasMountAccessor = userpass.Accessor,
        AllowedExtraAliasMountAccessors = new[]
        {
            extra.Accessor,
        },
        DefaultSchemaVersion = "2.2",
        AllowUserAdoption = true,
        AllowGroupAdoption = true,
        MaxActiveTokens = 5,
        MaxTokenTtl = 3600,
        DeletionPolicy = "orphan_child_resources",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.identity.Entity;
import com.pulumi.vault.identity.EntityArgs;
import com.pulumi.vault.ScimClient;
import com.pulumi.vault.ScimClientArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var userpass = new AuthBackend("userpass", AuthBackendArgs.builder()
            .type("userpass")
            .path("userpass-scim")
            .build());

        var extra = new AuthBackend("extra", AuthBackendArgs.builder()
            .type("userpass")
            .path("userpass-scim-extra")
            .build());

        var scimOperator = new Entity("scimOperator", EntityArgs.builder()
            .name("scim-operator")
            .build());

        var okta = new ScimClient("okta", ScimClientArgs.builder()
            .clientName("okta-prod")
            .accessGrantPrincipal(scimOperator.id())
            .aliasMountAccessor(userpass.accessor())
            .allowedExtraAliasMountAccessors(extra.accessor())
            .defaultSchemaVersion("2.2")
            .allowUserAdoption(true)
            .allowGroupAdoption(true)
            .maxActiveTokens(5)
            .maxTokenTtl(3600)
            .deletionPolicy("orphan_child_resources")
            .build());

    }
}

    resources:
  userpass:
    type: vault:AuthBackend
    properties:
      type: userpass
      path: userpass-scim
  extra:
    type: vault:AuthBackend
    properties:
      type: userpass
      path: userpass-scim-extra
  scimOperator:
    type: vault:identity:Entity
    name: scim_operator
    properties:
      name: scim-operator
  okta:
    type: vault:ScimClient
    properties:
      clientName: okta-prod
      accessGrantPrincipal: ${scimOperator.id}
      aliasMountAccessor: ${userpass.accessor}
      allowedExtraAliasMountAccessors:
        - ${extra.accessor}
      defaultSchemaVersion: '2.2'
      allowUserAdoption: true
      allowGroupAdoption: true
      maxActiveTokens: 5
      maxTokenTtl: 3600 # Keep linked entities and groups in Vault when this client is destroyed.
      deletionPolicy: orphan_child_resources

    terraform {
  required_providers {
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_auth_backend" "userpass" {
  lifecycle {
    create_before_destroy = true
  }
  type = "userpass"
  path = "userpass-scim"
}
resource "vault_auth_backend" "extra" {
  lifecycle {
    create_before_destroy = true
  }
  type = "userpass"
  path = "userpass-scim-extra"
}
resource "vault_identity_entity" "scim_operator" {
  lifecycle {
    create_before_destroy = true
  }
  name = "scim-operator"
}
resource "vault_scim_client" "okta" {
  lifecycle {
    create_before_destroy = true
  }
  client_name                         = "okta-prod"
  access_grant_principal              = vault_identity_entity.scim_operator.id
  alias_mount_accessor                = vault_auth_backend.userpass.accessor
  allowed_extra_alias_mount_accessors = [vault_auth_backend.extra.accessor]
  default_schema_version              = "2.2"
  allow_user_adoption                 = true
  allow_group_adoption                = true
  max_active_tokens                   = 5
  max_token_ttl                       = 3600
  # Keep linked entities and groups in Vault when this client is destroyed.
  deletion_policy = "orphan_child_resources"
}

    Destroying a client

    Deleting a SCIM client that still owns entities or groups needs an explicit choice, and Vault performs the cleanup in the background. Terraform waits until the client is gone, up to the delete timeout.

    With deletionPolicy unset, terraform destroy fails if the client still owns linked resources, with the error SCIM client has linked resources. To avoid this, set deletionPolicy and run pulumi up before running terraform destroy, because the value is read from state at destroy time.

    deletionPolicyEffect on linked entities and groups
    unsetPlain delete. Fails if the client owns any linked resources.
    orphanChildResourcesUnlinks them from the client and keeps them in Vault.
    deleteChildResourcesDeletes them together with the client.

    Create ScimClient Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ScimClient(name: string, args: ScimClientArgs, opts?: CustomResourceOptions);
    @overload
def ScimClient(resource_name: str,
               args: ScimClientArgs,
               opts: Optional[ResourceOptions] = None)

@overload
def ScimClient(resource_name: str,
               opts: Optional[ResourceOptions] = None,
               access_grant_principal: Optional[str] = None,
               client_name: Optional[str] = None,
               alias_mount_accessor: Optional[str] = None,
               allow_group_adoption: Optional[bool] = None,
               allow_user_adoption: Optional[bool] = None,
               allowed_extra_alias_mount_accessors: Optional[Sequence[str]] = None,
               default_schema_version: Optional[str] = None,
               deletion_policy: Optional[str] = None,
               max_active_tokens: Optional[int] = None,
               max_token_ttl: Optional[int] = None,
               namespace: Optional[str] = None)
    func NewScimClient(ctx *Context, name string, args ScimClientArgs, opts ...ResourceOption) (*ScimClient, error)
    public ScimClient(string name, ScimClientArgs args, CustomResourceOptions? opts = null)
    public ScimClient(String name, ScimClientArgs args)
public ScimClient(String name, ScimClientArgs args, CustomResourceOptions options)

    type: vault:ScimClient
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_scim_client" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args ScimClientArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ScimClientArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ScimClientArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ScimClientArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ScimClientArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var scimClientResource = new Vault.ScimClient("scimClientResource", new()
{
    AccessGrantPrincipal = "string",
    ClientName = "string",
    AliasMountAccessor = "string",
    AllowGroupAdoption = false,
    AllowUserAdoption = false,
    AllowedExtraAliasMountAccessors = new[]
    {
        "string",
    },
    DefaultSchemaVersion = "string",
    DeletionPolicy = "string",
    MaxActiveTokens = 0,
    MaxTokenTtl = 0,
    Namespace = "string",
});

    example, err := vault.NewScimClient(ctx, "scimClientResource", &vault.ScimClientArgs{
	AccessGrantPrincipal: pulumi.String("string"),
	ClientName:           pulumi.String("string"),
	AliasMountAccessor:   pulumi.String("string"),
	AllowGroupAdoption:   pulumi.Bool(false),
	AllowUserAdoption:    pulumi.Bool(false),
	AllowedExtraAliasMountAccessors: pulumi.StringArray{
		pulumi.String("string"),
	},
	DefaultSchemaVersion: pulumi.String("string"),
	DeletionPolicy:       pulumi.String("string"),
	MaxActiveTokens:      pulumi.Int(0),
	MaxTokenTtl:          pulumi.Int(0),
	Namespace:            pulumi.String("string"),
})

    resource "vault_scim_client" "scimClientResource" {
  lifecycle {
    create_before_destroy = true
  }
  access_grant_principal              = "string"
  client_name                         = "string"
  alias_mount_accessor                = "string"
  allow_group_adoption                = false
  allow_user_adoption                 = false
  allowed_extra_alias_mount_accessors = ["string"]
  default_schema_version              = "string"
  deletion_policy                     = "string"
  max_active_tokens                   = 0
  max_token_ttl                       = 0
  namespace                           = "string"
}

    var scimClientResource = new ScimClient("scimClientResource", ScimClientArgs.builder()
    .accessGrantPrincipal("string")
    .clientName("string")
    .aliasMountAccessor("string")
    .allowGroupAdoption(false)
    .allowUserAdoption(false)
    .allowedExtraAliasMountAccessors("string")
    .defaultSchemaVersion("string")
    .deletionPolicy("string")
    .maxActiveTokens(0)
    .maxTokenTtl(0)
    .namespace("string")
    .build());

    scim_client_resource = vault.ScimClient("scimClientResource",
    access_grant_principal="string",
    client_name="string",
    alias_mount_accessor="string",
    allow_group_adoption=False,
    allow_user_adoption=False,
    allowed_extra_alias_mount_accessors=["string"],
    default_schema_version="string",
    deletion_policy="string",
    max_active_tokens=0,
    max_token_ttl=0,
    namespace="string")

    const scimClientResource = new vault.ScimClient("scimClientResource", {
    accessGrantPrincipal: "string",
    clientName: "string",
    aliasMountAccessor: "string",
    allowGroupAdoption: false,
    allowUserAdoption: false,
    allowedExtraAliasMountAccessors: ["string"],
    defaultSchemaVersion: "string",
    deletionPolicy: "string",
    maxActiveTokens: 0,
    maxTokenTtl: 0,
    namespace: "string",
});

    type: vault:ScimClient
properties:
    accessGrantPrincipal: string
    aliasMountAccessor: string
    allowGroupAdoption: false
    allowUserAdoption: false
    allowedExtraAliasMountAccessors:
        - string
    clientName: string
    defaultSchemaVersion: string
    deletionPolicy: string
    maxActiveTokens: 0
    maxTokenTtl: 0
    namespace: string

    ScimClient Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ScimClient resource accepts the following input properties:

    AccessGrantPrincipal string
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    ClientName string
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    AliasMountAccessor string
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    AllowGroupAdoption bool
    Whether this client may adopt existing Vault groups. Defaults to false.
    AllowUserAdoption bool
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    AllowedExtraAliasMountAccessors List<string>
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    DefaultSchemaVersion string
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    DeletionPolicy string
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    MaxActiveTokens int
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    MaxTokenTtl int
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    AccessGrantPrincipal string
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    ClientName string
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    AliasMountAccessor string
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    AllowGroupAdoption bool
    Whether this client may adopt existing Vault groups. Defaults to false.
    AllowUserAdoption bool
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    AllowedExtraAliasMountAccessors []string
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    DefaultSchemaVersion string
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    DeletionPolicy string
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    MaxActiveTokens int
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    MaxTokenTtl int
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    access_grant_principal string
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    client_name string
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    alias_mount_accessor string
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    allow_group_adoption bool
    Whether this client may adopt existing Vault groups. Defaults to false.
    allow_user_adoption bool
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    allowed_extra_alias_mount_accessors list(string)
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    default_schema_version string
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    deletion_policy string
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    max_active_tokens number
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    max_token_ttl number
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    accessGrantPrincipal String
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    clientName String
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    aliasMountAccessor String
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    allowGroupAdoption Boolean
    Whether this client may adopt existing Vault groups. Defaults to false.
    allowUserAdoption Boolean
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    allowedExtraAliasMountAccessors List<String>
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    defaultSchemaVersion String
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    deletionPolicy String
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    maxActiveTokens Integer
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    maxTokenTtl Integer
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    accessGrantPrincipal string
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    clientName string
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    aliasMountAccessor string
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    allowGroupAdoption boolean
    Whether this client may adopt existing Vault groups. Defaults to false.
    allowUserAdoption boolean
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    allowedExtraAliasMountAccessors string[]
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    defaultSchemaVersion string
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    deletionPolicy string
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    maxActiveTokens number
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    maxTokenTtl number
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    access_grant_principal str
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    client_name str
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    alias_mount_accessor str
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    allow_group_adoption bool
    Whether this client may adopt existing Vault groups. Defaults to false.
    allow_user_adoption bool
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    allowed_extra_alias_mount_accessors Sequence[str]
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    default_schema_version str
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    deletion_policy str
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    max_active_tokens int
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    max_token_ttl int
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    accessGrantPrincipal String
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    clientName String
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    aliasMountAccessor String
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    allowGroupAdoption Boolean
    Whether this client may adopt existing Vault groups. Defaults to false.
    allowUserAdoption Boolean
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    allowedExtraAliasMountAccessors List<String>
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    defaultSchemaVersion String
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    deletionPolicy String
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    maxActiveTokens Number
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    maxTokenTtl Number
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ScimClient resource produces the following output properties:

    ClientId string
    The unique ID Vault assigned to the client. This is different from id.
    Deleting bool
    true while Vault is asynchronously cleaning up resources owned by this client.
    Id string
    The provider-assigned unique ID for this managed resource.
    ClientId string
    The unique ID Vault assigned to the client. This is different from id.
    Deleting bool
    true while Vault is asynchronously cleaning up resources owned by this client.
    Id string
    The provider-assigned unique ID for this managed resource.
    client_id string
    The unique ID Vault assigned to the client. This is different from id.
    deleting bool
    true while Vault is asynchronously cleaning up resources owned by this client.
    id string
    The provider-assigned unique ID for this managed resource.
    clientId String
    The unique ID Vault assigned to the client. This is different from id.
    deleting Boolean
    true while Vault is asynchronously cleaning up resources owned by this client.
    id String
    The provider-assigned unique ID for this managed resource.
    clientId string
    The unique ID Vault assigned to the client. This is different from id.
    deleting boolean
    true while Vault is asynchronously cleaning up resources owned by this client.
    id string
    The provider-assigned unique ID for this managed resource.
    client_id str
    The unique ID Vault assigned to the client. This is different from id.
    deleting bool
    true while Vault is asynchronously cleaning up resources owned by this client.
    id str
    The provider-assigned unique ID for this managed resource.
    clientId String
    The unique ID Vault assigned to the client. This is different from id.
    deleting Boolean
    true while Vault is asynchronously cleaning up resources owned by this client.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing ScimClient Resource

    Get an existing ScimClient resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ScimClientState, opts?: CustomResourceOptions): ScimClient
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        access_grant_principal: Optional[str] = None,
        alias_mount_accessor: Optional[str] = None,
        allow_group_adoption: Optional[bool] = None,
        allow_user_adoption: Optional[bool] = None,
        allowed_extra_alias_mount_accessors: Optional[Sequence[str]] = None,
        client_id: Optional[str] = None,
        client_name: Optional[str] = None,
        default_schema_version: Optional[str] = None,
        deleting: Optional[bool] = None,
        deletion_policy: Optional[str] = None,
        max_active_tokens: Optional[int] = None,
        max_token_ttl: Optional[int] = None,
        namespace: Optional[str] = None) -> ScimClient
    func GetScimClient(ctx *Context, name string, id IDInput, state *ScimClientState, opts ...ResourceOption) (*ScimClient, error)
    public static ScimClient Get(string name, Input<string> id, ScimClientState? state, CustomResourceOptions? opts = null)
    public static ScimClient get(String name, Output<String> id, ScimClientState state, CustomResourceOptions options)
    resources:  _:    type: vault:ScimClient    get:      id: ${id}
    import {
  to = vault_scim_client.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccessGrantPrincipal string
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    AliasMountAccessor string
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    AllowGroupAdoption bool
    Whether this client may adopt existing Vault groups. Defaults to false.
    AllowUserAdoption bool
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    AllowedExtraAliasMountAccessors List<string>
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    ClientId string
    The unique ID Vault assigned to the client. This is different from id.
    ClientName string
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    DefaultSchemaVersion string
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    Deleting bool
    true while Vault is asynchronously cleaning up resources owned by this client.
    DeletionPolicy string
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    MaxActiveTokens int
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    MaxTokenTtl int
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    AccessGrantPrincipal string
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    AliasMountAccessor string
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    AllowGroupAdoption bool
    Whether this client may adopt existing Vault groups. Defaults to false.
    AllowUserAdoption bool
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    AllowedExtraAliasMountAccessors []string
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    ClientId string
    The unique ID Vault assigned to the client. This is different from id.
    ClientName string
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    DefaultSchemaVersion string
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    Deleting bool
    true while Vault is asynchronously cleaning up resources owned by this client.
    DeletionPolicy string
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    MaxActiveTokens int
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    MaxTokenTtl int
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    access_grant_principal string
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    alias_mount_accessor string
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    allow_group_adoption bool
    Whether this client may adopt existing Vault groups. Defaults to false.
    allow_user_adoption bool
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    allowed_extra_alias_mount_accessors list(string)
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    client_id string
    The unique ID Vault assigned to the client. This is different from id.
    client_name string
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    default_schema_version string
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    deleting bool
    true while Vault is asynchronously cleaning up resources owned by this client.
    deletion_policy string
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    max_active_tokens number
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    max_token_ttl number
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    accessGrantPrincipal String
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    aliasMountAccessor String
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    allowGroupAdoption Boolean
    Whether this client may adopt existing Vault groups. Defaults to false.
    allowUserAdoption Boolean
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    allowedExtraAliasMountAccessors List<String>
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    clientId String
    The unique ID Vault assigned to the client. This is different from id.
    clientName String
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    defaultSchemaVersion String
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    deleting Boolean
    true while Vault is asynchronously cleaning up resources owned by this client.
    deletionPolicy String
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    maxActiveTokens Integer
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    maxTokenTtl Integer
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    accessGrantPrincipal string
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    aliasMountAccessor string
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    allowGroupAdoption boolean
    Whether this client may adopt existing Vault groups. Defaults to false.
    allowUserAdoption boolean
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    allowedExtraAliasMountAccessors string[]
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    clientId string
    The unique ID Vault assigned to the client. This is different from id.
    clientName string
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    defaultSchemaVersion string
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    deleting boolean
    true while Vault is asynchronously cleaning up resources owned by this client.
    deletionPolicy string
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    maxActiveTokens number
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    maxTokenTtl number
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    access_grant_principal str
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    alias_mount_accessor str
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    allow_group_adoption bool
    Whether this client may adopt existing Vault groups. Defaults to false.
    allow_user_adoption bool
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    allowed_extra_alias_mount_accessors Sequence[str]
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    client_id str
    The unique ID Vault assigned to the client. This is different from id.
    client_name str
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    default_schema_version str
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    deleting bool
    true while Vault is asynchronously cleaning up resources owned by this client.
    deletion_policy str
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    max_active_tokens int
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    max_token_ttl int
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.
    accessGrantPrincipal String
    The ID of the Vault entity authorized to call the SCIM protocol endpoints for this client. Each entity can be the principal of only one SCIM client.
    aliasMountAccessor String
    The accessor of an auth mount on which login aliases are created for provisioned users. The mount must not be local and must be in the same namespace as the client. It cannot be changed or cleared after creation, so changing it forces a new resource.
    allowGroupAdoption Boolean
    Whether this client may adopt existing Vault groups. Defaults to false.
    allowUserAdoption Boolean
    Whether this client may adopt existing unmanaged Vault entities. Defaults to false.
    allowedExtraAliasMountAccessors List<String>
    Set of additional mount accessors whose aliases may be managed by this client. Duplicate values are ignored and ordering is not significant.
    clientId String
    The unique ID Vault assigned to the client. This is different from id.
    clientName String
    The name of the SCIM client. Must be lowercase, because Vault lowercases client names when it stores them. May contain only letters, digits, _, - and ., and must start and end with a letter, digit or _. Changing this forces a new resource.
    defaultSchemaVersion String
    The SCIM extension schema version for this client. Must be "2.0" or "2.2". Defaults to "2.2" for new clients.
    deleting Boolean
    true while Vault is asynchronously cleaning up resources owned by this client.
    deletionPolicy String
    Controls how linked entities and groups are handled when the client is destroyed. One of orphanChildResources or deleteChildResources. Leave unset for a plain delete. This argument is tracked in Terraform state only and is never written to Vault. See Destroying a client.
    maxActiveTokens Number
    Maximum number of active SCIM tokens for this client. Must be at least 1. Defaults to 2.
    maxTokenTtl Number
    Maximum TTL, in seconds, of tokens issued for this client. Must be at least 0. 0 uses the cluster default. Defaults to 0.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace.

    Import

    A SCIM client can be imported using its clientName, e.g.

    $ pulumi import vault:index/scimClient:ScimClient okta okta-prod

    deletionPolicy is not stored in Vault, so an import does not set it. Add it to the configuration and run pulumi up before destroying the client.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.14.0
    published on Thursday, Oct 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial