@atensec/pulumi-thoth 0.1.3 → 0.1.5

package/access/{apiKey.ts → agentApiKey.ts}

@@ -4,9 +4,9 @@
 import * as pulumi from "@pulumi/pulumi";
 import * as utilities from "../utilities";
 
-export class ApiKey extends pulumi.CustomResource {
+export class AgentApiKey extends pulumi.CustomResource {
     /**
-     * Get an existing ApiKey resource's state with the given name, ID, and optional extra
+     * Get an existing AgentApiKey resource's state with the given name, ID, and optional extra
      * properties used to qualify the lookup.
      *
      * @param name The _unique_ name of the resulting resource.
@@ -14,22 +14,22 @@ export class ApiKey extends pulumi.CustomResource {
      * @param state Any extra arguments used during the lookup.
      * @param opts Optional settings to control the behavior of the CustomResource.
      */
-    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ApiKeyState, opts?: pulumi.CustomResourceOptions): ApiKey {
-        return new ApiKey(name, <any>state, { ...opts, id: id });
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: AgentApiKeyState, opts?: pulumi.CustomResourceOptions): AgentApiKey {
+        return new AgentApiKey(name, <any>state, { ...opts, id: id });
     }
 
     /** @internal */
-    public static readonly __pulumiType = 'thoth:access/apiKey:ApiKey';
+    public static readonly __pulumiType = 'thoth:access/agentApiKey:AgentApiKey';
 
     /**
-     * Returns true if the given object is an instance of ApiKey.  This is designed to work even
+     * Returns true if the given object is an instance of AgentApiKey.  This is designed to work even
      * when multiple copies of the Pulumi SDK have been loaded into the same process.
      */
-    public static isInstance(obj: any): obj is ApiKey {
+    public static isInstance(obj: any): obj is AgentApiKey {
         if (obj === undefined || obj === null) {
             return false;
         }
-        return obj['__pulumiType'] === ApiKey.__pulumiType;
+        return obj['__pulumiType'] === AgentApiKey.__pulumiType;
     }
 
     /**
@@ -73,13 +73,13 @@ export class ApiKey extends pulumi.CustomResource {
      */
     declare public /*out*/ readonly prefix: pulumi.Output<string>;
     /**
-     * Scope level: organization, fleet, endpoint, agent.
+     * Fixed scope for this resource type.
      */
-    declare public readonly scopeLevel: pulumi.Output<string>;
+    declare public /*out*/ readonly scopeLevel: pulumi.Output<string>;
     /**
-     * Target ID for scope level (not required for organization).
+     * Agent ID targeted by this API key scope.
      */
-    declare public readonly scopeTargetId: pulumi.Output<string | undefined>;
+    declare public readonly scopeTargetId: pulumi.Output<string>;
     /**
      * Tenant ID from provider configuration.
      */
@@ -90,18 +90,18 @@ export class ApiKey extends pulumi.CustomResource {
     declare public readonly ttlSeconds: pulumi.Output<number | undefined>;
 
     /**
-     * Create a ApiKey resource with the given unique name, arguments, and options.
+     * Create a AgentApiKey resource with the given unique name, arguments, and options.
      *
      * @param name The _unique_ name of the resource.
      * @param args The arguments to use to populate this resource's properties.
      * @param opts A bag of options that control this resource's behavior.
      */
-    constructor(name: string, args: ApiKeyArgs, opts?: pulumi.CustomResourceOptions)
-    constructor(name: string, argsOrState?: ApiKeyArgs | ApiKeyState, opts?: pulumi.CustomResourceOptions) {
+    constructor(name: string, args: AgentApiKeyArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: AgentApiKeyArgs | AgentApiKeyState, opts?: pulumi.CustomResourceOptions) {
         let resourceInputs: pulumi.Inputs = {};
         opts = opts || {};
         if (opts.id) {
-            const state = argsOrState as ApiKeyState | undefined;
+            const state = argsOrState as AgentApiKeyState | undefined;
             resourceInputs["active"] = state?.active;
             resourceInputs["apiKey"] = state?.apiKey;
             resourceInputs["createdAt"] = state?.createdAt;
@@ -117,17 +117,16 @@ export class ApiKey extends pulumi.CustomResource {
             resourceInputs["tenantId"] = state?.tenantId;
             resourceInputs["ttlSeconds"] = state?.ttlSeconds;
         } else {
-            const args = argsOrState as ApiKeyArgs | undefined;
+            const args = argsOrState as AgentApiKeyArgs | undefined;
             if (args?.permissions === undefined && !opts.urn) {
                 throw new Error("Missing required property 'permissions'");
             }
-            if (args?.scopeLevel === undefined && !opts.urn) {
-                throw new Error("Missing required property 'scopeLevel'");
+            if (args?.scopeTargetId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'scopeTargetId'");
             }
             resourceInputs["jitReason"] = args?.jitReason;
             resourceInputs["name"] = args?.name;
             resourceInputs["permissions"] = args?.permissions;
-            resourceInputs["scopeLevel"] = args?.scopeLevel;
             resourceInputs["scopeTargetId"] = args?.scopeTargetId;
             resourceInputs["ttlSeconds"] = args?.ttlSeconds;
             resourceInputs["active"] = undefined /*out*/;
@@ -137,19 +136,20 @@ export class ApiKey extends pulumi.CustomResource {
             resourceInputs["keyId"] = undefined /*out*/;
             resourceInputs["lastUsedAt"] = undefined /*out*/;
             resourceInputs["prefix"] = undefined /*out*/;
+            resourceInputs["scopeLevel"] = undefined /*out*/;
             resourceInputs["tenantId"] = undefined /*out*/;
         }
         opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
         const secretOpts = { additionalSecretOutputs: ["apiKey"] };
         opts = pulumi.mergeOptions(opts, secretOpts);
-        super(ApiKey.__pulumiType, name, resourceInputs, opts);
+        super(AgentApiKey.__pulumiType, name, resourceInputs, opts);
     }
 }
 
 /**
- * Input properties used for looking up and filtering ApiKey resources.
+ * Input properties used for looking up and filtering AgentApiKey resources.
  */
-export interface ApiKeyState {
+export interface AgentApiKeyState {
     /**
      * Whether key is currently active and not expired/revoked.
      */
@@ -191,11 +191,11 @@ export interface ApiKeyState {
      */
     prefix?: pulumi.Input<string | undefined>;
     /**
-     * Scope level: organization, fleet, endpoint, agent.
+     * Fixed scope for this resource type.
      */
     scopeLevel?: pulumi.Input<string | undefined>;
     /**
-     * Target ID for scope level (not required for organization).
+     * Agent ID targeted by this API key scope.
      */
     scopeTargetId?: pulumi.Input<string | undefined>;
     /**
@@ -209,9 +209,9 @@ export interface ApiKeyState {
 }
 
 /**
- * The set of arguments for constructing a ApiKey resource.
+ * The set of arguments for constructing a AgentApiKey resource.
  */
-export interface ApiKeyArgs {
+export interface AgentApiKeyArgs {
     /**
      * Audit reason for just-in-time issuance.
      */
@@ -225,13 +225,9 @@ export interface ApiKeyArgs {
      */
     permissions: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * Scope level: organization, fleet, endpoint, agent.
+     * Agent ID targeted by this API key scope.
      */
-    scopeLevel: pulumi.Input<string>;
-    /**
-     * Target ID for scope level (not required for organization).
-     */
-    scopeTargetId?: pulumi.Input<string | undefined>;
+    scopeTargetId: pulumi.Input<string>;
     /**
      * TTL in seconds for key expiry.
      */

package/access/endpointApiKey.ts

@@ -0,0 +1,235 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class EndpointApiKey extends pulumi.CustomResource {
+    /**
+     * Get an existing EndpointApiKey resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: EndpointApiKeyState, opts?: pulumi.CustomResourceOptions): EndpointApiKey {
+        return new EndpointApiKey(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:access/endpointApiKey:EndpointApiKey';
+
+    /**
+     * Returns true if the given object is an instance of EndpointApiKey.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is EndpointApiKey {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === EndpointApiKey.__pulumiType;
+    }
+
+    /**
+     * Whether key is currently active and not expired/revoked.
+     */
+    declare public /*out*/ readonly active: pulumi.Output<boolean>;
+    /**
+     * One-time plaintext API key (returned only on create).
+     */
+    declare public /*out*/ readonly apiKey: pulumi.Output<string>;
+    /**
+     * Creation timestamp.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * Expiry timestamp.
+     */
+    declare public /*out*/ readonly expiresAt: pulumi.Output<string>;
+    /**
+     * Audit reason for just-in-time issuance.
+     */
+    declare public readonly jitReason: pulumi.Output<string | undefined>;
+    /**
+     * GovAPI key identifier.
+     */
+    declare public /*out*/ readonly keyId: pulumi.Output<string>;
+    /**
+     * Last authorization timestamp.
+     */
+    declare public /*out*/ readonly lastUsedAt: pulumi.Output<string>;
+    /**
+     * Display name for the API key.
+     */
+    declare public readonly name: pulumi.Output<string | undefined>;
+    /**
+     * Allowed permissions: read, write, execute.
+     */
+    declare public readonly permissions: pulumi.Output<string[]>;
+    /**
+     * Key prefix for operator identification.
+     */
+    declare public /*out*/ readonly prefix: pulumi.Output<string>;
+    /**
+     * Fixed scope for this resource type.
+     */
+    declare public /*out*/ readonly scopeLevel: pulumi.Output<string>;
+    /**
+     * Endpoint ID targeted by this API key scope.
+     */
+    declare public readonly scopeTargetId: pulumi.Output<string>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * TTL in seconds for key expiry.
+     */
+    declare public readonly ttlSeconds: pulumi.Output<number | undefined>;
+
+    /**
+     * Create a EndpointApiKey resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: EndpointApiKeyArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: EndpointApiKeyArgs | EndpointApiKeyState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as EndpointApiKeyState | undefined;
+            resourceInputs["active"] = state?.active;
+            resourceInputs["apiKey"] = state?.apiKey;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["expiresAt"] = state?.expiresAt;
+            resourceInputs["jitReason"] = state?.jitReason;
+            resourceInputs["keyId"] = state?.keyId;
+            resourceInputs["lastUsedAt"] = state?.lastUsedAt;
+            resourceInputs["name"] = state?.name;
+            resourceInputs["permissions"] = state?.permissions;
+            resourceInputs["prefix"] = state?.prefix;
+            resourceInputs["scopeLevel"] = state?.scopeLevel;
+            resourceInputs["scopeTargetId"] = state?.scopeTargetId;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["ttlSeconds"] = state?.ttlSeconds;
+        } else {
+            const args = argsOrState as EndpointApiKeyArgs | undefined;
+            if (args?.permissions === undefined && !opts.urn) {
+                throw new Error("Missing required property 'permissions'");
+            }
+            if (args?.scopeTargetId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'scopeTargetId'");
+            }
+            resourceInputs["jitReason"] = args?.jitReason;
+            resourceInputs["name"] = args?.name;
+            resourceInputs["permissions"] = args?.permissions;
+            resourceInputs["scopeTargetId"] = args?.scopeTargetId;
+            resourceInputs["ttlSeconds"] = args?.ttlSeconds;
+            resourceInputs["active"] = undefined /*out*/;
+            resourceInputs["apiKey"] = undefined /*out*/;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["expiresAt"] = undefined /*out*/;
+            resourceInputs["keyId"] = undefined /*out*/;
+            resourceInputs["lastUsedAt"] = undefined /*out*/;
+            resourceInputs["prefix"] = undefined /*out*/;
+            resourceInputs["scopeLevel"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["apiKey"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(EndpointApiKey.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering EndpointApiKey resources.
+ */
+export interface EndpointApiKeyState {
+    /**
+     * Whether key is currently active and not expired/revoked.
+     */
+    active?: pulumi.Input<boolean | undefined>;
+    /**
+     * One-time plaintext API key (returned only on create).
+     */
+    apiKey?: pulumi.Input<string | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * Expiry timestamp.
+     */
+    expiresAt?: pulumi.Input<string | undefined>;
+    /**
+     * Audit reason for just-in-time issuance.
+     */
+    jitReason?: pulumi.Input<string | undefined>;
+    /**
+     * GovAPI key identifier.
+     */
+    keyId?: pulumi.Input<string | undefined>;
+    /**
+     * Last authorization timestamp.
+     */
+    lastUsedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Display name for the API key.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * Allowed permissions: read, write, execute.
+     */
+    permissions?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Key prefix for operator identification.
+     */
+    prefix?: pulumi.Input<string | undefined>;
+    /**
+     * Fixed scope for this resource type.
+     */
+    scopeLevel?: pulumi.Input<string | undefined>;
+    /**
+     * Endpoint ID targeted by this API key scope.
+     */
+    scopeTargetId?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * TTL in seconds for key expiry.
+     */
+    ttlSeconds?: pulumi.Input<number | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a EndpointApiKey resource.
+ */
+export interface EndpointApiKeyArgs {
+    /**
+     * Audit reason for just-in-time issuance.
+     */
+    jitReason?: pulumi.Input<string | undefined>;
+    /**
+     * Display name for the API key.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * Allowed permissions: read, write, execute.
+     */
+    permissions: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Endpoint ID targeted by this API key scope.
+     */
+    scopeTargetId: pulumi.Input<string>;
+    /**
+     * TTL in seconds for key expiry.
+     */
+    ttlSeconds?: pulumi.Input<number | undefined>;
+}

package/access/fleetApiKey.ts

@@ -0,0 +1,235 @@
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+
+import * as pulumi from "@pulumi/pulumi";
+import * as utilities from "../utilities";
+
+export class FleetApiKey extends pulumi.CustomResource {
+    /**
+     * Get an existing FleetApiKey resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    public static get(name: string, id: pulumi.Input<pulumi.ID>, state?: FleetApiKeyState, opts?: pulumi.CustomResourceOptions): FleetApiKey {
+        return new FleetApiKey(name, <any>state, { ...opts, id: id });
+    }
+
+    /** @internal */
+    public static readonly __pulumiType = 'thoth:access/fleetApiKey:FleetApiKey';
+
+    /**
+     * Returns true if the given object is an instance of FleetApiKey.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    public static isInstance(obj: any): obj is FleetApiKey {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === FleetApiKey.__pulumiType;
+    }
+
+    /**
+     * Whether key is currently active and not expired/revoked.
+     */
+    declare public /*out*/ readonly active: pulumi.Output<boolean>;
+    /**
+     * One-time plaintext API key (returned only on create).
+     */
+    declare public /*out*/ readonly apiKey: pulumi.Output<string>;
+    /**
+     * Creation timestamp.
+     */
+    declare public /*out*/ readonly createdAt: pulumi.Output<string>;
+    /**
+     * Expiry timestamp.
+     */
+    declare public /*out*/ readonly expiresAt: pulumi.Output<string>;
+    /**
+     * Audit reason for just-in-time issuance.
+     */
+    declare public readonly jitReason: pulumi.Output<string | undefined>;
+    /**
+     * GovAPI key identifier.
+     */
+    declare public /*out*/ readonly keyId: pulumi.Output<string>;
+    /**
+     * Last authorization timestamp.
+     */
+    declare public /*out*/ readonly lastUsedAt: pulumi.Output<string>;
+    /**
+     * Display name for the API key.
+     */
+    declare public readonly name: pulumi.Output<string | undefined>;
+    /**
+     * Allowed permissions: read, write, execute.
+     */
+    declare public readonly permissions: pulumi.Output<string[]>;
+    /**
+     * Key prefix for operator identification.
+     */
+    declare public /*out*/ readonly prefix: pulumi.Output<string>;
+    /**
+     * Fixed scope for this resource type.
+     */
+    declare public /*out*/ readonly scopeLevel: pulumi.Output<string>;
+    /**
+     * Fleet ID targeted by this API key scope.
+     */
+    declare public readonly scopeTargetId: pulumi.Output<string>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    declare public /*out*/ readonly tenantId: pulumi.Output<string>;
+    /**
+     * TTL in seconds for key expiry.
+     */
+    declare public readonly ttlSeconds: pulumi.Output<number | undefined>;
+
+    /**
+     * Create a FleetApiKey resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args: FleetApiKeyArgs, opts?: pulumi.CustomResourceOptions)
+    constructor(name: string, argsOrState?: FleetApiKeyArgs | FleetApiKeyState, opts?: pulumi.CustomResourceOptions) {
+        let resourceInputs: pulumi.Inputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState as FleetApiKeyState | undefined;
+            resourceInputs["active"] = state?.active;
+            resourceInputs["apiKey"] = state?.apiKey;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["expiresAt"] = state?.expiresAt;
+            resourceInputs["jitReason"] = state?.jitReason;
+            resourceInputs["keyId"] = state?.keyId;
+            resourceInputs["lastUsedAt"] = state?.lastUsedAt;
+            resourceInputs["name"] = state?.name;
+            resourceInputs["permissions"] = state?.permissions;
+            resourceInputs["prefix"] = state?.prefix;
+            resourceInputs["scopeLevel"] = state?.scopeLevel;
+            resourceInputs["scopeTargetId"] = state?.scopeTargetId;
+            resourceInputs["tenantId"] = state?.tenantId;
+            resourceInputs["ttlSeconds"] = state?.ttlSeconds;
+        } else {
+            const args = argsOrState as FleetApiKeyArgs | undefined;
+            if (args?.permissions === undefined && !opts.urn) {
+                throw new Error("Missing required property 'permissions'");
+            }
+            if (args?.scopeTargetId === undefined && !opts.urn) {
+                throw new Error("Missing required property 'scopeTargetId'");
+            }
+            resourceInputs["jitReason"] = args?.jitReason;
+            resourceInputs["name"] = args?.name;
+            resourceInputs["permissions"] = args?.permissions;
+            resourceInputs["scopeTargetId"] = args?.scopeTargetId;
+            resourceInputs["ttlSeconds"] = args?.ttlSeconds;
+            resourceInputs["active"] = undefined /*out*/;
+            resourceInputs["apiKey"] = undefined /*out*/;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["expiresAt"] = undefined /*out*/;
+            resourceInputs["keyId"] = undefined /*out*/;
+            resourceInputs["lastUsedAt"] = undefined /*out*/;
+            resourceInputs["prefix"] = undefined /*out*/;
+            resourceInputs["scopeLevel"] = undefined /*out*/;
+            resourceInputs["tenantId"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["apiKey"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(FleetApiKey.__pulumiType, name, resourceInputs, opts);
+    }
+}
+
+/**
+ * Input properties used for looking up and filtering FleetApiKey resources.
+ */
+export interface FleetApiKeyState {
+    /**
+     * Whether key is currently active and not expired/revoked.
+     */
+    active?: pulumi.Input<boolean | undefined>;
+    /**
+     * One-time plaintext API key (returned only on create).
+     */
+    apiKey?: pulumi.Input<string | undefined>;
+    /**
+     * Creation timestamp.
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * Expiry timestamp.
+     */
+    expiresAt?: pulumi.Input<string | undefined>;
+    /**
+     * Audit reason for just-in-time issuance.
+     */
+    jitReason?: pulumi.Input<string | undefined>;
+    /**
+     * GovAPI key identifier.
+     */
+    keyId?: pulumi.Input<string | undefined>;
+    /**
+     * Last authorization timestamp.
+     */
+    lastUsedAt?: pulumi.Input<string | undefined>;
+    /**
+     * Display name for the API key.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * Allowed permissions: read, write, execute.
+     */
+    permissions?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Key prefix for operator identification.
+     */
+    prefix?: pulumi.Input<string | undefined>;
+    /**
+     * Fixed scope for this resource type.
+     */
+    scopeLevel?: pulumi.Input<string | undefined>;
+    /**
+     * Fleet ID targeted by this API key scope.
+     */
+    scopeTargetId?: pulumi.Input<string | undefined>;
+    /**
+     * Tenant ID from provider configuration.
+     */
+    tenantId?: pulumi.Input<string | undefined>;
+    /**
+     * TTL in seconds for key expiry.
+     */
+    ttlSeconds?: pulumi.Input<number | undefined>;
+}
+
+/**
+ * The set of arguments for constructing a FleetApiKey resource.
+ */
+export interface FleetApiKeyArgs {
+    /**
+     * Audit reason for just-in-time issuance.
+     */
+    jitReason?: pulumi.Input<string | undefined>;
+    /**
+     * Display name for the API key.
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * Allowed permissions: read, write, execute.
+     */
+    permissions: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Fleet ID targeted by this API key scope.
+     */
+    scopeTargetId: pulumi.Input<string>;
+    /**
+     * TTL in seconds for key expiry.
+     */
+    ttlSeconds?: pulumi.Input<number | undefined>;
+}