ZITADEL Terraform Provider

https://github.com/zitadel/terraform-provider-zitadel
Admin
The official Terraform provider for ZITADEL that enables declarative management of identity and...
Tokens:105,786
Snippets:930
Trust Score:9.7
License:Apache-2.0
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### Example Usage: Fetch user grants and details

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/user_grants.md

This example retrieves all user grant IDs for a user using the zitadel_user_grants data source, then uses the zitadel_user_grant data source with a for_each to fetch details for each grant, and finally outputs the project IDs of those grants.

```terraform
data "zitadel_user_grants" "default" {
  org_id     = data.zitadel_org.default.id
  user_id    = data.zitadel_human_user.default.id
  project_id = data.zitadel_project.default.id
  role_key   = "example-role"
}

data "zitadel_user_grant" "default" {
  for_each = toset(data.zitadel_user_grants.default.ids)
  org_id   = data.zitadel_org.default.id
  user_id  = data.zitadel_human_user.default.id
  grant_id = each.value
}

output "user_grant_project_ids" {
  value = toset([
    for grant in data.zitadel_user_grant.default : grant.project_id
  ])
}
```

--------------------------------

### Example Usage: zitadel_login_texts Resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/login_texts.md

Configures custom text for the legacy login UI (v1) using the zitadel_login_texts resource. The example sets all available text fields to 'example' values for the 'en' language.

```terraform
resource "zitadel_login_texts" "default" {
  org_id   = data.zitadel_org.default.id
  language = "en"

  email_verification_done_text = {
    cancel_button_text = "example"
    description        = "example"
    login_button_text  = "example"
    next_button_text   = "example"
    title              = "example"
  }
  email_verification_text = {
    code_label         = "example"
    description        = "example"
    next_button_text   = "example"
    resend_button_text = "example"
    title              = "example"
  }
  external_registration_user_overview_text = {
    back_button_text      = "example"
    description           = "example"
    email_label           = "example"
    firstname_label       = "example"
    language_label        = "example"
    lastname_label        = "example"
    next_button_text      = "example"
    nickname_label        = "example"
    phone_label           = "example"
    privacy_link_text     = "example"
    title                 = "example"
    tos_and_privacy_label = "example"
    tos_confirm           = "example"
    tos_confirm_and       = "example"
    tos_link_text         = "example"
    username_label        = "example"
  }
  external_user_not_found_text = {
    auto_register_button_text = "example"
    description               = "example"
    link_button_text          = "example"
    privacy_link_text         = "example"
    title                     = "example"
    tos_and_privacy_label     = "example"
    tos_confirm               = "example"
    tos_confirm_and           = "example"
    tos_link_text             = "example"
  }
  footer_text = {
    help           = "example"
    privacy_policy = "example"
    tos            = "example"
  }
  init_mfa_done_text = {
    cancel_button_text = "example"
    description        = "example"
    next_button_text   = "example"
    title              = "example"
  }
  init_mfa_otp_text = {
    cancel_button_text = "example"
    code_label         = "example"
    description        = "example"
    description_otp    = "example"
    next_button_text   = "example"
    secret_label       = "example"
    title              = "example"
  }
  init_mfa_prompt_text = {
    description      = "example"
    next_button_text = "example"
    otp_option       = "example"
    skip_button_text = "example"
    title            = "example"
    u2f_option       = "example"
  }
  init_mfa_u2f_text = {
    description                = "example"
    error_retry                = "example"
    not_supported              = "example"
    register_token_button_text = "example"
    title                      = "example"
    token_name_label           = "example"
  }
  init_password_done_text = {
    cancel_button_text = "example"
    description        = "example"
    next_button_text   = "example"
    title              = "example"
  }
  init_password_text = {
    code_label                 = "example"
    description                = "example"
    new_password_confirm_label = "example"
    new_password_label         = "example"
    next_button_text           = "example"
    resend_button_text         = "example"
    title                      = "example"
  }
  initialize_done_text = {
    cancel_button_text = "example"
    description        = "example"
    next_button_text   = "example"
    title              = "example"
  }
  initialize_user_text = {
    code_label                 = "example"
    description                = "example"
    new_password_confirm_label = "example"
    new_password_label         = "example"
    next_button_text           = "example"
    resend_button_text         = "example"
    title                      = "example"
  }
  linking_user_done_text = {
    cancel_button_text = "example"
    description        = "example"
    next_button_text   = "example"
    title              = "example"
  }
  login_text = {
    description                 = "example"
    description_linking_process = "example"
    external_user_description   = "example"
    login_name_label            = "example"
    login_name_placeholder      = "example"
    next_button_text            = "example"
    register_button_text        = "example"

```

--------------------------------

### Example Usage: zitadel_idp_gitlab_self_hosted Data Source

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/idp_gitlab_self_hosted.md

Use this data source to retrieve an existing GitLab Self Hosted IDP by its ID. The example shows the required 'id' argument.

```terraform
data "zitadel_idp_gitlab_self_hosted" "default" {
  id = "123456789012345678"
}

```

--------------------------------

### Example Usage of zitadel_project_role Data Source

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/project_role.md

This example retrieves a project role using the `zitadel_project_role` data source, specifying the organization ID, project ID, and role key. It then outputs the data source result.

```terraform
data "zitadel_project_role" "default" {
  org_id     = data.zitadel_org.default.id
  project_id = data.zitadel_project.default.id
  role_key   = "key"
}

output "project_role" {
  value = data.zitadel_project_role.default
}
```

--------------------------------

### Example: Data Source "zitadel_idp_oauth"

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/idp_oauth.md

This example retrieves the generic OAuth2 IDP with the specified ID. The data source requires the `id` attribute, and outputs read-only fields such as `client_id`, `authorization_endpoint`, and `scopes`.

```terraform
data "zitadel_idp_oauth" "default" {
  id = "123456789012345678"
}

```

--------------------------------

### Data source example for zitadel_application_oidc

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/application_oidc.md

Use this data source to fetch an existing OIDC application by its app_id, project_id, and optionally org_id. The example references other data sources for org and project IDs.

```terraform
data "zitadel_application_oidc" "default" {
  org_id     = data.zitadel_org.default.id
  project_id = data.zitadel_project.default.id
  app_id     = "123456789012345678"
}
```

--------------------------------

### Format code with golangci-lint and terraform fmt

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/CONTRIBUTING.md

Formats Go code and Terraform example files. Uses golangci-lint v2.6.2 and terraform fmt.

```bash
# Format go code
go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.6.2 run --fix

# Format Terraform example files
terraform fmt -recursive
```

--------------------------------

### Example Usage: zitadel_org_idp_gitlab

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/org_idp_gitlab.md

This example retrieves a GitLab IdP by its ID and optionally the organization ID. The org_id is set to the ID of the default organization, and the id is a placeholder that should be replaced with the actual ID.

```terraform
data "zitadel_org_idp_gitlab" "default" {
  org_id = data.zitadel_org.default.id
  id     = "123456789012345678"
}
```

--------------------------------

### Import a zitadel_domain resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/domain.md

Imports an existing domain using the ID format `name[:org_id]`. The example imports a domain with name `example.com` and org ID `123456789012345678`.

```bash
# The resource can be imported using the ID format `name[:org_id]`, e.g.
terraform import zitadel_domain.imported 'example.com:123456789012345678'
```

--------------------------------

### Import a default hosted login translation resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/default_hosted_login_translation.md

Imports the resource using the ID format `<language>`, for example 'en'.

```bash
# The resource can be imported using the ID format `<language>`, e.g.
terraform import zitadel_default_hosted_login_translation.imported 'en'
```

--------------------------------

### Example Usage: zitadel_project data source

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/project.md

Use this data source to retrieve information about an existing ZITADEL project by its ID. The example references the organization ID from another data source and sets the project_id attribute. This block is typically used to fetch project details for use elsewhere in the configuration.

```terraform
data "zitadel_project" "default" {
  org_id     = data.zitadel_org.default.id
  project_id = "123456789012345678"
}
```

--------------------------------

### Run acceptance tests with TF_ACC

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/CONTRIBUTING.md

Runs the acceptance tests. Requires the machine key generated by the ZITADEL setup step.

```bash
TF_ACC=1 go test ./...
```

--------------------------------

### Import an action target public key

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/action_target_public_key.md

Imports an existing public key using the ID format `<key_id>:<target_id>`. The example shows the command with placeholder IDs.

```bash
# The resource can be imported using the ID format `<key_id>:<target_id>`, e.g.
terraform import zitadel_action_target_public_key.imported '123456789012345678:123456789012345678'
```

--------------------------------

### Import an existing zitadel_login_policy

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/login_policy.md

Shows how to import an existing login policy using the ID format `<[org_id]>`. The example command imports a policy with the ID '123456789012345678'.

```bash
# The resource can be imported using the ID format `<[org_id]>`, e.g.
terraform import zitadel_login_policy.imported '123456789012345678'
```

--------------------------------

### Import a zitadel_project resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/project.md

Imports an existing project using the ID format `<id[:org_id]>`. The example shows importing with both project ID and org ID separated by a colon.

```bash
# The resource can be imported using the ID format `<id[:org_id]>`, e.g.
terraform import zitadel_project.imported '123456789012345678:123456789012345678'
```

--------------------------------

### Import zitadel_organization_metadata resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/organization_metadata.md

Imports an existing organization metadata resource using the ID format `<organization_id:key>`. The example shows importing with a specific organization ID and key.

```bash
# The resource can be imported using the ID format `<organization_id:key>`, e.g.
terraform import zitadel_organization_metadata.imported '123456789012345678:example_key'

```

--------------------------------

### Import a GitHub IdP resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/org_idp_github.md

Imports an existing `zitadel_org_idp_github` resource using the ID format `<id[:org_id][:client_secret]>`. The example shows a command with placeholder values.

```bash
terraform import zitadel_org_idp_github.imported '123456789012345678:123456789012345678:1234567890123456781234567890123456787890'
```

--------------------------------

### Import an Azure AD IdP resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/org_idp_azure_ad.md

Shows how to import the resource using the ID format `<id[:org_id][:client_secret]>`. The example uses a placeholder ID and client secret.

```bash
# The resource can be imported using the ID format `<id[:org_id][:client_secret]>`, e.g.
terraform import zitadel_org_idp_azure_ad.imported '123456789012345678:123456789012345678:12345678-1234-1234-1234-123456789012'
```

--------------------------------

### Import a zitadel_idp_oidc resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/idp_oidc.md

Imports an existing zitadel_idp_oidc resource using the ID format `<id[:client_secret]>`. The example shows importing with an ID and client secret.

```bash
# The resource can be imported using the ID format `<id[:client_secret]>`, e.g.
terraform import zitadel_idp_oidc.imported '123456789012345678:1234567890abcdef'
```

--------------------------------

### Setup local ZITADEL with Docker Compose

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/CONTRIBUTING.md

Sets up a local ZITADEL instance using Docker Compose. Requires the acceptance/docker-compose.yaml file and sets the ZITADEL_DEV_UID environment variable to the current user's ID.

```bash
# To have the machine key written with the correct ownership, set your current users ID.
export ZITADEL_DEV_UID="$(id -u)"

# Setup ZITADEL
docker compose --file ./acceptance/docker-compose.yaml run setup
```

--------------------------------

### Generate docs with tfplugindocs

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/CONTRIBUTING.md

Generates documentation from the /templates and /examples directories. Requires manual maintenance of those files.

```bash
go run github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs@v0.14.1 generate
```

--------------------------------

### Import Commands for Event, Group, and All

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/action_execution_event.md

Shows how to import the resource using different identifiers: `event:name` for a specific event, `group:name` for an event group, and `all` for all events.

```bash
# event:name for specific event, group:name for event group, all for all events
terraform import zitadel_action_execution_event.imported 'event:user.human.added'
terraform import zitadel_action_execution_event.imported 'group:user.human'
terraform import zitadel_action_execution_event.imported 'all'
```

--------------------------------

### Example Usage: zitadel_org_idp_oidc data source

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/org_idp_oidc.md

Retrieves an existing OIDC IdP by its ID, optionally scoped to an organization. The example references a ZITADEL organization data source and outputs the retrieved IdP data.

```terraform
data "zitadel_org_idp_oidc" "default" {
  org_id = data.zitadel_org.default.id
  id     = "123456789012345678"
}

output "org_idp_oidc" {
  value = data.zitadel_org_idp_oidc.default
}
```

--------------------------------

### Import Commands for zitadel_action_execution_response

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/action_execution_response.md

Shows how to import the resource by method, service, or all responses. The comment explains the import ID format.

```bash
# method:/path for specific method, service:name for service, all for all responses
terraform import zitadel_action_execution_response.imported 'method:/zitadel.user.v2.UserService/GetUser'
terraform import zitadel_action_execution_response.imported 'service:zitadel.user.v2.UserService'
terraform import zitadel_action_execution_response.imported 'all'
```

--------------------------------

### Import zitadel_instance_features resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/instance_features.md

Imports the `zitadel_instance_features` resource using the constant ID "instance".

```bash
# The resource can be imported using the constant ID "instance"
terraform import zitadel_instance_features.imported 'instance'
```

--------------------------------

### Example Usage: Activate a web key

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/active_webkey.md

Creates two web keys (RSA and ECDSA) and then activates one of them using the `zitadel_active_webkey` resource. The `key_id` references the ID of the web key to activate.

```terraform
resource "zitadel_webkey" "key_v1" {
  org_id = data.zitadel_org.default.id
  rsa {}
}

resource "zitadel_webkey" "key_v2" {
  org_id = data.zitadel_org.default.id
  ecdsa {}
}

resource "zitadel_active_webkey" "default" {
  org_id = data.zitadel_org.default.id
  key_id = zitadel_webkey.key_v1.id
}
```

--------------------------------

### Configure verify_mfa_otp_text and verify_mfa_u2f_text

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/default_login_texts.md

Example configuration for the default login texts resource, showing the verify_mfa_otp_text and verify_mfa_u2f_text blocks with placeholder values. The language attribute is required, and all other attributes are optional.

```hcl
  verify_mfa_otp_text = {
    code_label       = "example"
    description      = "example"
    next_button_text = "example"
    title            = "example"
  }
  verify_mfa_u2f_text = {
    description         = "example"
    error_retry         = "example"
    not_supported       = "example"
    title               = "example"
    validate_token_text = "example"
  }
}
```

--------------------------------

### Example Usage of zitadel_organization_domains Data Source

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/organization_domains.md

Example usage of the zitadel_organization_domains data source. It shows two data source blocks: one without a domain filter and one with a domain filter, followed by an output block that references the domains attribute of the default data source.

```terraform
data "zitadel_organization_domains" "default" {
  organization_id = "123456789012345678"
}

data "zitadel_organization_domains" "filtered" {
  organization_id = "123456789012345678"
  domain          = "example.com"
}

output "all_domains" {
  value = data.zitadel_organization_domains.default.domains
}

```

--------------------------------

### Import zitadel_application_oidc Resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/application_oidc.md

Imports an OIDC application using the ID format `<id:project_id[:org_id][:client_id][:client_secret]>`. The example shows the exact command with a placeholder resource name and a sample import string.

```bash
# The resource can be imported using the ID format `<id:project_id[:org_id][:client_id][:client_secret]>`, e.g.
terraform import zitadel_application_oidc.imported '123456789012345678:123456789012345678:123456789012345678:123456789012345678@zitadel:JuaDFFeOak5DGE655KCYPSAclSkbMVEJXXuX1lEMBT14eLMSs0A0qhafKX5SA2Df'
```

--------------------------------

### Create default passwordless registration message text resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/default_passwordless_registration_message_text.md

Defines a Terraform resource for the instance-level default passwordless registration message text. The `language` attribute is required; other fields like `title`, `pre_header`, `subject`, `greeting`, `text`, `button_text`, and `footer_text` are optional. This example sets all optional fields to example values.

```terraform
resource "zitadel_default_passwordless_registration_message_text" "default" {
  language = "en"

  title       = "title example"
  pre_header  = "pre_header example"
  subject     = "subject example"
  greeting    = "greeting example"
  text        = "text example"
  button_text = "button_text example"
  footer_text = "footer_text example"
}
```

--------------------------------

### Import zitadel_email_provider_smtp

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/email_provider_smtp.md

Imports the resource using the ID format `<id>:<password>`. The password must be included to allow future updates.

```bash
# The resource can be imported using the ID format `<id>:<password>`, e.g.
terraform import zitadel_email_provider_smtp.imported '123456789012345678:password'

```

--------------------------------

### Data source example: zitadel_idp_ldap

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/idp_ldap.md

Retrieves an LDAP IDP by its ID. The ID is required and must be a string.

```terraform
data "zitadel_idp_ldap" "default" {
  id = "123456789012345678"
}

```

--------------------------------

### zitadel_instance_features Data Source

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/instance_features.md

Terraform data source documentation for zitadel_instance_features, including example usage and schema attributes.

```APIDOC
## Data Source: zitadel_instance_features

### Description
Datasource representing the feature flags configuration for an instance.

### Example Usage
```terraform
data "zitadel_instance_features" "default" {}
```

### Schema

#### Read-Only

- `console_use_v2_user_api` (Boolean) If this is enabled the console web client will use the new User v2 API for certain calls
- `debug_oidc_parent_error` (Boolean) Return parent errors to OIDC clients for debugging purposes. Parent errors may contain sensitive data or unwanted details about the system status of zitadel. Only enable if really needed.
- `enable_back_channel_logout` (Boolean) If the flag is enabled, you'll be able to use the OIDC Back-Channel Logout to be notified in your application about terminated user sessions.
- `id` (String) The ID of this resource.
- `improved_performance` (Set of String) Improves performance of specified execution paths.
- `login_default_org` (Boolean) The login UI will use the settings of the default org (and not from the instance) if no organization context is set
- `login_v2` (List of Object) Specify the login UI for all users and applications regardless of their preference. (see [below for nested schema](#nestedatt--login_v2))
- `oidc_single_v1_session_termination` (Boolean) If the flag is enabled, you'll be able to terminate a single session from the login UI by providing an id_token with a `sid` claim as id_token_hint on the end_session endpoint. Note that currently all sessions from the same user agent (browser) are terminated in the login UI. Sessions managed through the Session API already allow the termination of single sessions.
- `oidc_token_exchange` (Boolean) Enable the experimental `urn:ietf:params:oauth:grant-type:token-exchange` grant type for the OIDC token endpoint. Token exchange can be used to request tokens with a lesser scope or impersonate other users. See the security policy to allow impersonation on an instance.
- `permission_check_v2` (Boolean) Enable a newer, more performant, permission check used for v2 and v3 resource based APIs.
- `user_schema` (Boolean) User Schemas allow to manage data schemas of user. If the flag is enabled, you'll be able to use the new API and its features. Note that it is still in an early stage.

#### Nested Schema for `login_v2`

Read-Only:

- `base_uri` (String)
- `required` (Boolean)
```

--------------------------------

### Query SAML applications and fetch details

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/application_samls.md

This example queries SAML applications by name using the 'TEXT_QUERY_METHOD_CONTAINS_IGNORE_CASE' method, then uses the resulting app_ids to fetch each application's details and output their names.

```terraform
data "zitadel_application_samls" "default" {
  org_id      = data.zitadel_org.default.id
  project_id  = data.zitadel_project.default.id
  name        = "example-name"
  name_method = "TEXT_QUERY_METHOD_CONTAINS_IGNORE_CASE"
}

data "zitadel_application_saml" "default" {
  for_each = toset(data.zitadel_application_samls.default.app_ids)
  id = each.value
}

output "app_saml_names" {
  value = toset([
    for app in data.zitadel_application_saml.default : app.name
  ])
}
```

--------------------------------

### Example Usage: zitadel_action_target_public_key

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/action_target_public_key.md

Retrieves a public key for an action target using the required target_id and key_id attributes.

```terraform
data "zitadel_action_target_public_key" "default" {
  target_id = "123456789012345678"
  key_id    = "123456789012345678"
}

```

--------------------------------

### zitadel_idp_github Data Source Example

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/idp_github.md

Defines a data source for a GitHub IDP on the instance, using the required id attribute.

```terraform
data "zitadel_idp_github" "default" {
  id = "123456789012345678"
}

```

--------------------------------

### Query organizations and output names

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/orgs.md

This example queries organizations by name, domain, and state, then uses the resulting IDs to fetch each organization and output their names. It demonstrates the use of `zitadel_orgs` and `zitadel_org` data sources.

```terraform
data "zitadel_orgs" "default" {
  name          = "example-name"
  name_method   = "TEXT_QUERY_METHOD_CONTAINS_IGNORE_CASE"
  domain        = "example.com"
  domain_method = "TEXT_QUERY_METHOD_CONTAINS_IGNORE_CASE"
  state         = "ORG_STATE_ACTIVE"
}

data "zitadel_org" "default" {
  for_each = toset(data.zitadel_orgs.default.ids)
  id = each.value
}

output "org_names" {
  value = toset([
    for org in data.zitadel_org.default : org.name
  ])
}
```

--------------------------------

### Import a zitadel_org_idp_jwt resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/org_idp_jwt.md

Shows how to import the resource using the ID format `<id[:org_id]>`. The example uses the ID `123456789012345678:123456789012345678`.

```bash
# The resource can be imported using the ID format `<id[:org_id]>`, e.g.
terraform import zitadel_org_idp_jwt.imported '123456789012345678:123456789012345678'
```

--------------------------------

### Import HTTP email provider with signing key

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/email_provider_http.md

Imports an existing HTTP email provider using the ID format `<id>:<signing_key>`. The signing key is required for import.

```bash
# The resource can be imported using the ID format `<id>:<signing_key>`, e.g.
terraform import zitadel_email_provider_http.imported '123456789012345678:your-signing-key'
```

--------------------------------

### Import a ZITADEL web key

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/webkey.md

Imports an existing web key resource using its ID, optionally including the organization ID.

```bash
# The resource can be imported using the ID format `<id[:org_id]>`, e.g.
terraform import zitadel_webkey.imported '123456789012345678:123456789012345678'

```

--------------------------------

### Example Usage: zitadel_action_execution_event

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/action_execution_event.md

Defines a data source for an action execution event with the ID set to the condition, e.g., `event:user.human.added`.

```terraform
data "zitadel_action_execution_event" "default" {
	id = "event:user.human.added"
}
```

--------------------------------

### Use zitadel data source to get session token

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/zitadel.md

Defines the zitadel data source and outputs its token as a sensitive value.

```terraform
data "zitadel" "default" {
  //
}

output "token" {
  value     = data.zitadel.default.token
  sensitive = true
}
```

--------------------------------

### zitadel_org_idp_oidc Resource

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/org_idp_oidc.md

Terraform resource for managing a generic OIDC IdP on the organization. It includes example usage, schema definitions, and import instructions.

```APIDOC
## Resource: zitadel_org_idp_oidc

### Description
Resource representing a generic OIDC IdP on the organization.

### Example Usage
```terraform
resource "zitadel_org_idp_oidc" "default" {
  org_id              = data.zitadel_org.default.id
  name                = "My Generic OIDC IDP"
  client_id           = "a_client_id"
  client_secret       = "a_client_secret"
  scopes = ["openid", "profile", "email"]
  issuer              = "https://example.com"
  is_linking_allowed  = false
  is_creation_allowed = true
  is_auto_creation    = false
  is_auto_update      = true
  is_id_token_mapping = true
  auto_linking        = "AUTO_LINKING_OPTION_USERNAME"
}
```

### Schema

#### Required
- `client_id` (String) - client id generated by the identity provider
- `client_secret` (String, Sensitive) - client secret generated by the identity provider. This value is write-only and is never stored in Terraform state; it cannot be read back or retrieved from a datasource.
- `is_auto_creation` (Boolean) - enable if a new account in ZITADEL should be created automatically on login with an external account
- `is_auto_update` (Boolean) - enable if a the ZITADEL account fields should be updated automatically on each login
- `is_creation_allowed` (Boolean) - enable if users should be able to create a new account in ZITADEL when using an external account
- `is_id_token_mapping` (Boolean) - if true, provider information get mapped from the id token, not from the userinfo endpoint
- `is_linking_allowed` (Boolean) - enable if users should be able to link an existing ZITADEL user with an external account
- `issuer` (String) - the OIDC issuer of the identity provider

#### Optional
- `auto_linking` (String) - Enable if users should get prompted to link an existing ZITADEL user to an external account if the selected attribute matches, supported values: AUTO_LINKING_OPTION_UNSPECIFIED, AUTO_LINKING_OPTION_USERNAME, AUTO_LINKING_OPTION_EMAIL
- `name` (String) - Name of the IDP
- `org_id` (String) - ID of the organization. If not provided, the organization of the authenticated user/service account is used.
- `scopes` (Set of String) - the scopes requested by ZITADEL during the request on the identity provider
- `use_pkce` (Boolean) - Defines if the Proof Key for Code Exchange (PKCE) is used for the authorization code flow.

#### Read-Only
- `client_secret_hash` (String, Sensitive) - A non-reversible hash of the write-only client_secret, used to detect when the secret changes. It does not contain the secret itself.
- `id` (String) - The ID of this resource.

### Import
```bash
# The resource can be imported using the ID format `<id[:org_id][:client_secret]>`, e.g.
terraform import zitadel_org_idp_oidc.imported '123456789012345678:123456789012345678:1234567890abcdef'
```
```

--------------------------------

### Import: Import active webkey

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/active_webkey.md

Imports the resource using the ID format `<org_id>:<key_id>`. The example shows importing with placeholder IDs.

```bash
# The resource can be imported using the ID format `<org_id>:<key_id>`, e.g.
terraform import zitadel_active_webkey.imported '123456789012345678:123456789012345678'
```

--------------------------------

### Example Usage: zitadel_action_execution_request

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/data-sources/action_execution_request.md

Defines a data source for an action execution request. The id must be set to the condition, e.g., 'method:/zitadel.session.v2.SessionService/ListSessions'.

```terraform
data "zitadel_action_execution_request" "default" {
	id = "method:/zitadel.session.v2.SessionService/ListSessions"
}
```

--------------------------------

### Example Usage: zitadel_action_execution_response

Source: https://github.com/zitadel/terraform-provider-zitadel/blob/main/docs/resources/action_execution_response.md

Creates an action target and an action execution response that triggers on the GetUser method. The target is a REST call to enrich responses.

```terraform
resource "zitadel_action_target" "default" {
	name               = "response-enricher"
	endpoint           = "https://example.com/api/enrich"
	target_type        = "REST_CALL"
	timeout            = "10s"
	interrupt_on_error = false
}

resource "zitadel_action_execution_response" "default" {
	method = "/zitadel.user.v2.UserService/GetUser"
	target_ids = [zitadel_action_target.default.id]
}
```
Tokens:
Raw