Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. Zscaler Private Access (ZPA)
  4. API Docs
  5. getProvisioningKey
Viewing docs for Zscaler Private Access v1.0.4
published on Monday, Jun 29, 2026 by Zscaler
Schema (JSON)
zscaler/pulumi-zpa

zpa.getProvisioningKey

zpa logo
Viewing docs for Zscaler Private Access v1.0.4
published on Monday, Jun 29, 2026 by Zscaler
Schema (JSON)
zscaler/pulumi-zpa

    Use the zpa_provisioning_key data source to get information about a provisioning key in the Zscaler Private Access portal or via API. This data source can be referenced in the following ZPA resources:

    • App Connector Groups
    • Service Edge Groups

    NOTE The associationType parameter is required in order to distinguish between CONNECTOR_GRP and SERVICE_EDGE_GRP

    NOTE: To ensure consistent search results across data sources, please avoid using multiple spaces or special characters in your search queries.

    Zenith Community - ZPA Provisioning Keys

    ZPA Terraform provider Video Series Ep3 - Provisioning Keys

    Example Usage

    Basic Usage

    import * as pulumi from "@pulumi/pulumi";
import * as zpa from "@bdzscaler/pulumi-zpa";

// ZPA Provisioning Key for "CONNECTOR_GRP"
const connectorKey = zpa.getProvisioningKey({
    name: "Connector_Provisioning_Key",
    associationType: "CONNECTOR_GRP",
});

    import pulumi
import pulumi_zpa as zpa

# ZPA Provisioning Key for "CONNECTOR_GRP"
connector_key = zpa.get_provisioning_key(name="Connector_Provisioning_Key",
    association_type="CONNECTOR_GRP")

    package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/zscaler/pulumi-zpa/sdk/go/zpa"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// ZPA Provisioning Key for "CONNECTOR_GRP"
		_, err := zpa.GetProvisioningKey(ctx, &zpa.LookupProvisioningKeyArgs{
			Name:            pulumi.StringRef("Connector_Provisioning_Key"),
			AssociationType: "CONNECTOR_GRP",
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Zpa = zscaler.PulumiPackage.Zpa;

return await Deployment.RunAsync(() => 
{
    // ZPA Provisioning Key for "CONNECTOR_GRP"
    var connectorKey = Zpa.GetProvisioningKey.Invoke(new()
    {
        Name = "Connector_Provisioning_Key",
        AssociationType = "CONNECTOR_GRP",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.zpa.ZpaFunctions;
import com.pulumi.zpa.inputs.GetProvisioningKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // ZPA Provisioning Key for "CONNECTOR_GRP"
        final var connectorKey = ZpaFunctions.getProvisioningKey(GetProvisioningKeyArgs.builder()
            .name("Connector_Provisioning_Key")
            .associationType("CONNECTOR_GRP")
            .build());

    }
}

    variables:
  # ZPA Provisioning Key for "CONNECTOR_GRP"
  connectorKey:
    fn::invoke:
      function: zpa:getProvisioningKey
      arguments:
        name: Connector_Provisioning_Key
        associationType: CONNECTOR_GRP

    pulumi {
  required_providers {
    zpa = {
      source = "pulumi/zpa"
    }
  }
}

data "zpa_getprovisioningkey" "connectorKey" {
  name             = "Connector_Provisioning_Key"
  association_type = "CONNECTOR_GRP"
}

# ZPA Provisioning Key for "CONNECTOR_GRP"

    import * as pulumi from "@pulumi/pulumi";
import * as zpa from "@bdzscaler/pulumi-zpa";

// ZPA Provisioning Key for "SERVICE_EDGE_GRP"
const serviceEdgeKey = zpa.getProvisioningKey({
    name: "ServiceEdge_Provisioning_Key",
    associationType: "SERVICE_EDGE_GRP",
});

    import pulumi
import pulumi_zpa as zpa

# ZPA Provisioning Key for "SERVICE_EDGE_GRP"
service_edge_key = zpa.get_provisioning_key(name="ServiceEdge_Provisioning_Key",
    association_type="SERVICE_EDGE_GRP")

    package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/zscaler/pulumi-zpa/sdk/go/zpa"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// ZPA Provisioning Key for "SERVICE_EDGE_GRP"
		_, err := zpa.GetProvisioningKey(ctx, &zpa.LookupProvisioningKeyArgs{
			Name:            pulumi.StringRef("ServiceEdge_Provisioning_Key"),
			AssociationType: "SERVICE_EDGE_GRP",
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Zpa = zscaler.PulumiPackage.Zpa;

return await Deployment.RunAsync(() => 
{
    // ZPA Provisioning Key for "SERVICE_EDGE_GRP"
    var serviceEdgeKey = Zpa.GetProvisioningKey.Invoke(new()
    {
        Name = "ServiceEdge_Provisioning_Key",
        AssociationType = "SERVICE_EDGE_GRP",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.zpa.ZpaFunctions;
import com.pulumi.zpa.inputs.GetProvisioningKeyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // ZPA Provisioning Key for "SERVICE_EDGE_GRP"
        final var serviceEdgeKey = ZpaFunctions.getProvisioningKey(GetProvisioningKeyArgs.builder()
            .name("ServiceEdge_Provisioning_Key")
            .associationType("SERVICE_EDGE_GRP")
            .build());

    }
}

    variables:
  # ZPA Provisioning Key for "SERVICE_EDGE_GRP"
  serviceEdgeKey:
    fn::invoke:
      function: zpa:getProvisioningKey
      arguments:
        name: ServiceEdge_Provisioning_Key
        associationType: SERVICE_EDGE_GRP

    pulumi {
  required_providers {
    zpa = {
      source = "pulumi/zpa"
    }
  }
}

data "zpa_getprovisioningkey" "serviceEdgeKey" {
  name             = "ServiceEdge_Provisioning_Key"
  association_type = "SERVICE_EDGE_GRP"
}

# ZPA Provisioning Key for "SERVICE_EDGE_GRP"

    Accessing the Provisioning Key Value

    The provisioning key value is marked as sensitive and can be accessed using outputs or resource references:

    import * as pulumi from "@pulumi/pulumi";
import * as _null from "@pulumi/null";
import * as command from "@pulumi/command";
import * as zpa from "@bdzscaler/pulumi-zpa";

// Retrieve existing provisioning key
const existing = zpa.getProvisioningKey({
    name: "Production_Connector_Key",
    associationType: "CONNECTOR_GRP",
});
export const provisioningKeyValue = existing.then(existing => existing.provisioningKey);
// Use in automation
const deployConnector = new _null.Resource("deploy_connector", {});
const deployConnectorProvisioner0 = new command.local.Command("deployConnectorProvisioner0", {create: existing.then(existing => `deploy-connector.sh ${existing.provisioningKey}`)}, {
    dependsOn: [deployConnector],
});

    import pulumi
import pulumi_command as command
import pulumi_null as null
import pulumi_zpa as zpa

# Retrieve existing provisioning key
existing = zpa.get_provisioning_key(name="Production_Connector_Key",
    association_type="CONNECTOR_GRP")
pulumi.export("provisioningKeyValue", existing.provisioning_key)
# Use in automation
deploy_connector = null.Resource("deploy_connector")
deploy_connector_provisioner0 = command.local.Command("deployConnectorProvisioner0", create=f"deploy-connector.sh {existing.provisioning_key}",
opts = pulumi.ResourceOptions(depends_on=[deploy_connector]))

    package main

import (
	"github.com/pulumi/pulumi-command/sdk/go/command/local"
	"github.com/pulumi/pulumi-null/sdk/go/null"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/zscaler/pulumi-zpa/sdk/go/zpa"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Retrieve existing provisioning key
		existing, err := zpa.GetProvisioningKey(ctx, &zpa.LookupProvisioningKeyArgs{
			Name:            pulumi.StringRef("Production_Connector_Key"),
			AssociationType: "CONNECTOR_GRP",
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("provisioningKeyValue", existing.ProvisioningKey)
		// Use in automation
		deployConnector, err := null.NewResource(ctx, "deploy_connector", nil)
		if err != nil {
			return err
		}
		_, err = local.NewCommand(ctx, "deployConnectorProvisioner0", &local.CommandArgs{
			Create: pulumi.Sprintf("deploy-connector.sh %v", existing.ProvisioningKey),
		}, pulumi.DependsOn([]pulumi.Resource{
			deployConnector,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Command = Pulumi.Command;
using Null = Pulumi.Null;
using Zpa = zscaler.PulumiPackage.Zpa;

return await Deployment.RunAsync(() => 
{
    // Retrieve existing provisioning key
    var existing = Zpa.GetProvisioningKey.Invoke(new()
    {
        Name = "Production_Connector_Key",
        AssociationType = "CONNECTOR_GRP",
    });

    // Use in automation
    var deployConnector = new Null.Resource("deploy_connector");

    var deployConnectorProvisioner0 = new Command.Local.Command("deployConnectorProvisioner0", new()
    {
        Create = $"deploy-connector.sh {existing.Apply(getProvisioningKeyResult => getProvisioningKeyResult.ProvisioningKey)}",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            deployConnector,
        },
    });

    return new Dictionary<string, object?>
    {
        ["provisioningKeyValue"] = existing.Apply(getProvisioningKeyResult => getProvisioningKeyResult.ProvisioningKey),
    };
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.zpa.ZpaFunctions;
import com.pulumi.zpa.inputs.GetProvisioningKeyArgs;
import com.pulumi.null.Resource;
import com.pulumi.command.local.Command;
import com.pulumi.command.local.CommandArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // Retrieve existing provisioning key
        final var existing = ZpaFunctions.getProvisioningKey(GetProvisioningKeyArgs.builder()
            .name("Production_Connector_Key")
            .associationType("CONNECTOR_GRP")
            .build());

        ctx.export("provisioningKeyValue", existing.provisioningKey());
        // Use in automation
        var deployConnector = new Resource("deployConnector");

        var deployConnectorProvisioner0 = new Command("deployConnectorProvisioner0", CommandArgs.builder()
            .create(String.format("deploy-connector.sh %s", existing.provisioningKey()))
            .build(), CustomResourceOptions.builder()
                .dependsOn(deployConnector)
                .build());

    }
}

    resources:
  # Use in automation
  deployConnector:
    type: null:Resource
    name: deploy_connector
  deployConnectorProvisioner0:
    type: command:local:Command
    properties:
      create: deploy-connector.sh ${existing.provisioningKey}
    options:
      dependsOn:
        - ${deployConnector}
variables:
  # Retrieve existing provisioning key
  existing:
    fn::invoke:
      function: zpa:getProvisioningKey
      arguments:
        name: Production_Connector_Key
        associationType: CONNECTOR_GRP
outputs:
  # Output the provisioning key (marked as sensitive)
  provisioningKeyValue: ${existing.provisioningKey}

    pulumi {
  required_providers {
    command = {
      source = "pulumi/command"
    }
    null = {
      source = "pulumi/null"
    }
    zpa = {
      source = "pulumi/zpa"
    }
  }
}

data "zpa_getprovisioningkey" "existing" {
  name             = "Production_Connector_Key"
  association_type = "CONNECTOR_GRP"
}

# Use in automation
resource "null_resource" "deploy_connector" {
}
resource "command_local_command" "deployConnectorProvisioner0" {
  replace_on_changes = ["triggers[*]"]
  depends_on         = [null_resource.deploy_connector]
  create             ="deploy-connector.sh ${data.zpa_getprovisioningkey.existing.provisioning_key}"
}
# Retrieve existing provisioning key
# Output the provisioning key (marked as sensitive)
output "provisioningKeyValue" {
  value = data.zpa_getprovisioningkey.existing.provisioning_key
}

    To retrieve the key value:

    # View the provisioning key
terraform output provisioning_key_value

# Or get it programmatically
terraform output -json provisioning_key_value | jq -r .

    Using getProvisioningKey

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getProvisioningKey(args: GetProvisioningKeyArgs, opts?: InvokeOptions): Promise<GetProvisioningKeyResult>
function getProvisioningKeyOutput(args: GetProvisioningKeyOutputArgs, opts?: InvokeOptions): Output<GetProvisioningKeyResult>
    def get_provisioning_key(association_type: Optional[str] = None,
                         id: Optional[str] = None,
                         microtenant_id: Optional[str] = None,
                         microtenant_name: Optional[str] = None,
                         name: Optional[str] = None,
                         opts: Optional[InvokeOptions] = None) -> GetProvisioningKeyResult
def get_provisioning_key_output(association_type: pulumi.Input[Optional[str]] = None,
                         id: pulumi.Input[Optional[str]] = None,
                         microtenant_id: pulumi.Input[Optional[str]] = None,
                         microtenant_name: pulumi.Input[Optional[str]] = None,
                         name: pulumi.Input[Optional[str]] = None,
                         opts: Optional[InvokeOptions] = None) -> Output[GetProvisioningKeyResult]
    func LookupProvisioningKey(ctx *Context, args *LookupProvisioningKeyArgs, opts ...InvokeOption) (*LookupProvisioningKeyResult, error)
func LookupProvisioningKeyOutput(ctx *Context, args *LookupProvisioningKeyOutputArgs, opts ...InvokeOption) LookupProvisioningKeyResultOutput

    > Note: This function is named LookupProvisioningKey in the Go SDK.

    public static class GetProvisioningKey 
{
    public static Task<GetProvisioningKeyResult> InvokeAsync(GetProvisioningKeyArgs args, InvokeOptions? opts = null)
    public static Output<GetProvisioningKeyResult> Invoke(GetProvisioningKeyInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetProvisioningKeyResult> getProvisioningKey(GetProvisioningKeyArgs args, InvokeOptions options)
public static Output<GetProvisioningKeyResult> getProvisioningKey(GetProvisioningKeyArgs args, InvokeOptions options)

    fn::invoke:
  function: zpa:index/getProvisioningKey:getProvisioningKey
  arguments:
    # arguments dictionary
    data "zpa_getprovisioningkey" "name" {
    # arguments
}

    The following arguments are supported:

    AssociationType string
    Id string
    MicrotenantId string
    MicrotenantName string
    Name string
    AssociationType string
    Id string
    MicrotenantId string
    MicrotenantName string
    Name string
    association_type string
    id string
    microtenant_id string
    microtenant_name string
    name string
    associationType String
    id String
    microtenantId String
    microtenantName String
    name String
    associationType string
    id string
    microtenantId string
    microtenantName string
    name string
    associationType String
    id String
    microtenantId String
    microtenantName String
    name String

    getProvisioningKey Result

    The following output properties are available:

    Package Details

    Repository
    zpa zscaler/pulumi-zpa
    License
    MIT
    Notes
    This Pulumi package is based on the zpa Terraform Provider.
    zpa logo
    Viewing docs for Zscaler Private Access v1.0.4
    published on Monday, Jun 29, 2026 by Zscaler
    Schema (JSON)
    zscaler/pulumi-zpa

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial