@incident-io/pulumi 0.1.0-alpha.1

package/apiKey.d.ts

@@ -0,0 +1,276 @@
+import * as pulumi from "@pulumi/pulumi";
+/**
+ * Manage API keys for your organization.
+ *
+ * This API lets you view, create, update, delete, and rotate API keys programmatically, including configuring account-level roles and roles scoped to specific teams.
+ *
+ * Common use cases include:
+ * - **API key rotation**: You can issue a new access token for any API key using the `Rotate` endpoint.
+ * - **Managing keys at scale**: use the `Show`, `List`, `Create`, `Update`, and `Delete` endpoints to automate API key lifecycle management.
+ *
+ * ## Permissions model
+ *
+ * To use these endpoints, your API key must have the `apiKeysManage` role granted at either the account level or for specific teams.
+ *
+ * In addition, the following rules apply, when a "caller" API key is managing a "target" API key:
+ *
+ * - A caller key can only assign roles whose scopes are a subset of its own scopes. For example, a key with `viewer` and `incidentCreator` can assign those roles to a target key, but cannot assign the `incidentEditor` role, since it has additional scopes.
+ * - The same applies at the team level: A caller key with `schedulesEditor` at the account level can create a target key with that role for a specific team, but a key with `schedulesEditor` only for one team (Team A, say) cannot assign it at the account level or for another team, Team B.
+ * - The `apiKeysManage` role cannot be assigned via the API. To create a key with that role, you must go to Settings → API keys in the dashboard, and click "Add new", creating a key with the "View, create, edit, delete or rotate API keys" role (`apiKeysManage`).
+ * - The `Delete` endpoint does not check whether the calling API key holds the scopes of the key being deleted. However, a team-scoped key can only delete keys belonging to its teams.
+ * - To rotate the token of an API key, use the Rotate endpoint or by clicking "Rotate token" on any API key listed in the dashboard. The same permissions limitations apply as when creating or updating an API key.
+ *
+ * ## Finding role names and team IDs
+ *
+ * To find valid values for `roleNames`, `teamIds`, and `teamRoleNames`, go to Settings → API keys in the dashboard. Click to either edit an existing key or create a new one, select the desired roles and teams, and then use the copy button to get hold of the role and team identifiers as JSON.
+ *
+ * Manages an API key: the credential an integration authenticates to incident.io with, and the roles that decide what it may do.
+ *
+ * ## The token
+ *
+ * incident.io returns a key's token when it issues one - when the key is created, and each time it is rotated - and at no other time. A read cannot recover it, so Terraform keeps it in state, in the `token` attribute. It is marked sensitive, so Terraform will not print it, but **anything that can read your state can read the token**: treat the state file as the credential it now contains, and pass `token` on to wherever it is needed through a sensitive output or variable rather than copying it around.
+ *
+ * A key adopted with `pulumi import` has no token, because the one it was created with is gone and cannot be re-read. Rotate it to get a token Terraform can hand on.
+ *
+ * ## Rotating
+ *
+ * `tokenVersion` is your own counter, and changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. The plan says so, `token` becomes known after apply, and the previous token keeps working for `rotationGracePeriodMinutes` so that whatever holds it has a window to pick up the new one.
+ *
+ * Editing a key's roles or name never rotates it: the token outlives its permissions, and a key whose scopes you have just narrowed carries on working. Rotate deliberately if a permissions change means the old token should stop being accepted.
+ *
+ * ## Roles
+ *
+ * `roleNames` grants a role across the whole account. `teamRoleNames` grants roles only for the teams in `teamIds`, so those two go together: set both, or neither.
+ *
+ * incident.io will not let a key grant more than its own bearer holds, so the key running Terraform has to already have every role it assigns. It also refuses to assign `apiKeysManage` at all, which means a Terraform-managed key cannot itself manage keys.
+ *
+ * Neither rule is decided by this provider - which roles your own key holds is not something a configuration can know - so the plan asks incident.io whether the key it describes would be accepted. A role you cannot grant is reported when you plan, rather than part way through an apply. If that check cannot be reached the plan warns and carries on, so the rejection may still arrive at apply time.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as incident from "@incident-io/pulumi";
+ *
+ * // incident.io returns an API key's token when it issues one - on create, and on each
+ * // rotation - and never again. Terraform keeps it in state, so anything that can read your
+ * // state can read the token: treat the state file as the credential it now holds.
+ * const ci = new incident.ApiKey("ci", {
+ *     name: "CI deploy key",
+ *     comments: "Requested in #ask-infra, used by the deploy pipeline",
+ *     roleNames: [
+ *         "viewer",
+ *         "catalog_viewer",
+ *     ],
+ * });
+ * export const ciApiKeyToken = ci.token;
+ * // Rotating is asked for by changing token_version - conventionally by incrementing it.
+ * // That's the change Terraform can see, since the token itself is invisible to a plan.
+ * // The previous token keeps working for rotation_grace_period_minutes, giving whatever
+ * // holds it a window to pick up the new one.
+ * const rotatedQuarterly = new incident.ApiKey("rotated_quarterly", {
+ *     name: "Terraform state reader",
+ *     roleNames: ["viewer"],
+ *     tokenVersion: 2,
+ *     rotationGracePeriodMinutes: 60,
+ * });
+ * // A key can be scoped to particular teams instead of the whole account. team_ids says
+ * // which teams, and team_role_names says what the key may do for them, so the two go
+ * // together: set both, or neither. An account with no account-level roles leaves
+ * // role_names out entirely.
+ * const platformTeamSchedules = new incident.ApiKey("platform_team_schedules", {
+ *     name: "Platform team schedule sync",
+ *     teamIds: ["01G0J1EXE7AXZ2C93K61WBPYEH"],
+ *     teamRoleNames: [
+ *         "schedules_editor",
+ *         "on_call_editor",
+ *     ],
+ * });
+ * // Editing a key's roles never rotates it: the token outlives its permissions. Rotate
+ * // deliberately if narrowing a key's scopes should also stop the old token being accepted.
+ * const narrowed = new incident.ApiKey("narrowed", {
+ *     name: "Read-only reporting key",
+ *     roleNames: ["viewer"],
+ *     tokenVersion: 3,
+ *     rotationGracePeriodMinutes: 0,
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * Import is supported using an `import` block or the `pulumi import` command:
+ *
+ * The `pulumi import` command can be used, for example:
+ *
+ * !/bin/bash
+ *
+ * Import an API key using its ID
+ * Replace the ID with a real ID from your incident.io organization
+ *
+ * ```sh
+ * $ pulumi import incident:index/apiKey:ApiKey example 01ABC123DEF456GHI789JKL
+ * ```
+ *
+ * An imported key has no token: the one it was issued with went to whoever created it and
+ * can't be read back, so `token` is null. It has no tokenVersion either, so a config that
+ * sets one will rotate the key on the first apply - which is also the only way to get a
+ * token for a key Terraform has adopted. The plan says so before it happens.
+ */
+export declare class ApiKey extends pulumi.CustomResource {
+    /**
+     * Get an existing ApiKey resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: ApiKeyState, opts?: pulumi.CustomResourceOptions): ApiKey;
+    /**
+     * Returns true if the given object is an instance of ApiKey.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj: any): obj is ApiKey;
+    /**
+     * Freeform notes about this API key
+     */
+    readonly comments: pulumi.Output<string | undefined>;
+    /**
+     * When the API key was created
+     */
+    readonly createdAt: pulumi.Output<string>;
+    /**
+     * When the key was last used to authenticate a request
+     */
+    readonly lastUsedAt: pulumi.Output<string>;
+    /**
+     * The name of the API key, for the user's reference
+     */
+    readonly name: pulumi.Output<string>;
+    /**
+     * Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
+     */
+    readonly roleNames: pulumi.Output<string[]>;
+    /**
+     * How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to `tokenVersion` rotates the key.
+     */
+    readonly rotationGracePeriodMinutes: pulumi.Output<number>;
+    /**
+     * IDs of teams to scope the `teamRoleNames` to. If provided, `teamRoleNames` must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
+     */
+    readonly teamIds: pulumi.Output<string[]>;
+    /**
+     * Roles to grant for the teams specified in `teamIds`. If provided, `teamIds` must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.
+     *
+     * API key role name that may be granted for team-scoped access. Possible values are: `catalogEditor`, `schedulesEditor`, `schedulesReader`, `scheduleOverridesEditor`, `onCallEditor`, `escalationCreator`, `apiKeysManage`, `workflowsEditor`, `privateWorkflowsEditor`, `secretsManage`, `secretsUse`, `heartbeatsPing`, `telemetryQueryRestricted`, `telemetryDataSourceUpdate`.
+     */
+    readonly teamRoleNames: pulumi.Output<string[]>;
+    /**
+     * The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with `terraform import`, whose token was issued before Terraform knew about it - rotate the key to get one.
+     */
+    readonly token: pulumi.Output<string>;
+    /**
+     * When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
+     */
+    readonly tokenLastIssuedAt: pulumi.Output<string>;
+    /**
+     * The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
+     */
+    readonly tokenVersion: pulumi.Output<number | undefined>;
+    /**
+     * Create a ApiKey resource with the given unique name, arguments, and options.
+     *
+     * @param name The _unique_ name of the resource.
+     * @param args The arguments to use to populate this resource's properties.
+     * @param opts A bag of options that control this resource's behavior.
+     */
+    constructor(name: string, args?: ApiKeyArgs, opts?: pulumi.CustomResourceOptions);
+}
+/**
+ * Input properties used for looking up and filtering ApiKey resources.
+ */
+export interface ApiKeyState {
+    /**
+     * Freeform notes about this API key
+     */
+    comments?: pulumi.Input<string | undefined>;
+    /**
+     * When the API key was created
+     */
+    createdAt?: pulumi.Input<string | undefined>;
+    /**
+     * When the key was last used to authenticate a request
+     */
+    lastUsedAt?: pulumi.Input<string | undefined>;
+    /**
+     * The name of the API key, for the user's reference
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
+     */
+    roleNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to `tokenVersion` rotates the key.
+     */
+    rotationGracePeriodMinutes?: pulumi.Input<number | undefined>;
+    /**
+     * IDs of teams to scope the `teamRoleNames` to. If provided, `teamRoleNames` must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
+     */
+    teamIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Roles to grant for the teams specified in `teamIds`. If provided, `teamIds` must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.
+     *
+     * API key role name that may be granted for team-scoped access. Possible values are: `catalogEditor`, `schedulesEditor`, `schedulesReader`, `scheduleOverridesEditor`, `onCallEditor`, `escalationCreator`, `apiKeysManage`, `workflowsEditor`, `privateWorkflowsEditor`, `secretsManage`, `secretsUse`, `heartbeatsPing`, `telemetryQueryRestricted`, `telemetryDataSourceUpdate`.
+     */
+    teamRoleNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * The bearer token to authenticate as this key, which incident.io returns only when it issues one: on create, and on each rotation. Terraform stores it, because nothing can read it back afterwards, so anything with access to your state can read it. Null for a key adopted with `terraform import`, whose token was issued before Terraform knew about it - rotate the key to get one.
+     */
+    token?: pulumi.Input<string | undefined>;
+    /**
+     * When the current token for this API was last issued. This is the last time the token was rotated, or when it was initially created. Older tokens may remain valid for up to an hour after they have been rotated, configured when you call the rotate endpoint.
+     */
+    tokenLastIssuedAt?: pulumi.Input<string | undefined>;
+    /**
+     * The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
+     */
+    tokenVersion?: pulumi.Input<number | undefined>;
+}
+/**
+ * The set of arguments for constructing a ApiKey resource.
+ */
+export interface ApiKeyArgs {
+    /**
+     * Freeform notes about this API key
+     */
+    comments?: pulumi.Input<string | undefined>;
+    /**
+     * The name of the API key, for the user's reference
+     */
+    name?: pulumi.Input<string | undefined>;
+    /**
+     * Account-level roles to assign to the API key. These roles apply across the entire account, not scoped to specific teams. Pass an empty array if no account-level roles are needed.
+     */
+    roleNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * How long the previous token keeps working after a rotation, in minutes, giving whatever holds it a window to pick up the new one. Defaults to 30. Set it to 0 to retire the old token immediately, at the cost of breaking anything still using it. incident.io documents an hour as the longest a rotated token stays valid, so it may reject a longer period. Only read when a change to `tokenVersion` rotates the key.
+     */
+    rotationGracePeriodMinutes?: pulumi.Input<number | undefined>;
+    /**
+     * IDs of teams to scope the `teamRoleNames` to. If provided, `teamRoleNames` must also be a non-empty array, and vice versa. Pass an empty array if the key should not be scoped to any teams.
+     */
+    teamIds?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * Roles to grant for the teams specified in `teamIds`. If provided, `teamIds` must also be a non-empty array, and vice versa. Pass an empty array if no team-level roles are needed.
+     *
+     * API key role name that may be granted for team-scoped access. Possible values are: `catalogEditor`, `schedulesEditor`, `schedulesReader`, `scheduleOverridesEditor`, `onCallEditor`, `escalationCreator`, `apiKeysManage`, `workflowsEditor`, `privateWorkflowsEditor`, `secretsManage`, `secretsUse`, `heartbeatsPing`, `telemetryQueryRestricted`, `telemetryDataSourceUpdate`.
+     */
+    teamRoleNames?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+    /**
+     * The version of the token this configuration holds. Terraform stores this number, so changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. It is your own counter, and incident.io never sees it. Leave it unset to manage a key's name and roles without ever rotating it.
+     */
+    tokenVersion?: pulumi.Input<number | undefined>;
+}
+//# sourceMappingURL=apiKey.d.ts.map

package/apiKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKey.d.ts","sourceRoot":"","sources":["../apiKey.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAGzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoHG;AACH,qBAAa,MAAO,SAAQ,MAAM,CAAC,cAAc;IAC7C;;;;;;;;OAQG;WACW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB,GAAG,MAAM;IAO9H;;;OAGG;WACW,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,MAAM;IAOjD;;OAEG;IACH,SAAwB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpE;;OAEG;IACH,SAAgC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjE;;OAEG;IACH,SAAgC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClE;;OAEG;IACH,SAAwB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD;;OAEG;IACH,SAAwB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D;;OAEG;IACH,SAAwB,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1E;;OAEG;IACH,SAAwB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD;;;;OAIG;IACH,SAAwB,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D;;OAEG;IACH,SAAgC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D;;OAEG;IACH,SAAgC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE;;OAEG;IACH,SAAwB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAExE;;;;;;OAMG;gBACS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB;CAoCnF;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IACxB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9C;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;IAC7D;;OAEG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9D;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;IAC3D;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;IACjE;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrD;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACvB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;IAC7D;;OAEG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9D;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;IAC3D;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;IACjE;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD"}

package/apiKey.js

@@ -0,0 +1,211 @@
+"use strict";
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKey = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const utilities = __importStar(require("./utilities"));
+/**
+ * Manage API keys for your organization.
+ *
+ * This API lets you view, create, update, delete, and rotate API keys programmatically, including configuring account-level roles and roles scoped to specific teams.
+ *
+ * Common use cases include:
+ * - **API key rotation**: You can issue a new access token for any API key using the `Rotate` endpoint.
+ * - **Managing keys at scale**: use the `Show`, `List`, `Create`, `Update`, and `Delete` endpoints to automate API key lifecycle management.
+ *
+ * ## Permissions model
+ *
+ * To use these endpoints, your API key must have the `apiKeysManage` role granted at either the account level or for specific teams.
+ *
+ * In addition, the following rules apply, when a "caller" API key is managing a "target" API key:
+ *
+ * - A caller key can only assign roles whose scopes are a subset of its own scopes. For example, a key with `viewer` and `incidentCreator` can assign those roles to a target key, but cannot assign the `incidentEditor` role, since it has additional scopes.
+ * - The same applies at the team level: A caller key with `schedulesEditor` at the account level can create a target key with that role for a specific team, but a key with `schedulesEditor` only for one team (Team A, say) cannot assign it at the account level or for another team, Team B.
+ * - The `apiKeysManage` role cannot be assigned via the API. To create a key with that role, you must go to Settings → API keys in the dashboard, and click "Add new", creating a key with the "View, create, edit, delete or rotate API keys" role (`apiKeysManage`).
+ * - The `Delete` endpoint does not check whether the calling API key holds the scopes of the key being deleted. However, a team-scoped key can only delete keys belonging to its teams.
+ * - To rotate the token of an API key, use the Rotate endpoint or by clicking "Rotate token" on any API key listed in the dashboard. The same permissions limitations apply as when creating or updating an API key.
+ *
+ * ## Finding role names and team IDs
+ *
+ * To find valid values for `roleNames`, `teamIds`, and `teamRoleNames`, go to Settings → API keys in the dashboard. Click to either edit an existing key or create a new one, select the desired roles and teams, and then use the copy button to get hold of the role and team identifiers as JSON.
+ *
+ * Manages an API key: the credential an integration authenticates to incident.io with, and the roles that decide what it may do.
+ *
+ * ## The token
+ *
+ * incident.io returns a key's token when it issues one - when the key is created, and each time it is rotated - and at no other time. A read cannot recover it, so Terraform keeps it in state, in the `token` attribute. It is marked sensitive, so Terraform will not print it, but **anything that can read your state can read the token**: treat the state file as the credential it now contains, and pass `token` on to wherever it is needed through a sensitive output or variable rather than copying it around.
+ *
+ * A key adopted with `pulumi import` has no token, because the one it was created with is gone and cannot be re-read. Rotate it to get a token Terraform can hand on.
+ *
+ * ## Rotating
+ *
+ * `tokenVersion` is your own counter, and changing it - conventionally by incrementing it - is what asks incident.io to rotate the key. The plan says so, `token` becomes known after apply, and the previous token keeps working for `rotationGracePeriodMinutes` so that whatever holds it has a window to pick up the new one.
+ *
+ * Editing a key's roles or name never rotates it: the token outlives its permissions, and a key whose scopes you have just narrowed carries on working. Rotate deliberately if a permissions change means the old token should stop being accepted.
+ *
+ * ## Roles
+ *
+ * `roleNames` grants a role across the whole account. `teamRoleNames` grants roles only for the teams in `teamIds`, so those two go together: set both, or neither.
+ *
+ * incident.io will not let a key grant more than its own bearer holds, so the key running Terraform has to already have every role it assigns. It also refuses to assign `apiKeysManage` at all, which means a Terraform-managed key cannot itself manage keys.
+ *
+ * Neither rule is decided by this provider - which roles your own key holds is not something a configuration can know - so the plan asks incident.io whether the key it describes would be accepted. A role you cannot grant is reported when you plan, rather than part way through an apply. If that check cannot be reached the plan warns and carries on, so the rejection may still arrive at apply time.
+ *
+ * ## Example Usage
+ *
+ * ```typescript
+ * import * as pulumi from "@pulumi/pulumi";
+ * import * as incident from "@incident-io/pulumi";
+ *
+ * // incident.io returns an API key's token when it issues one - on create, and on each
+ * // rotation - and never again. Terraform keeps it in state, so anything that can read your
+ * // state can read the token: treat the state file as the credential it now holds.
+ * const ci = new incident.ApiKey("ci", {
+ *     name: "CI deploy key",
+ *     comments: "Requested in #ask-infra, used by the deploy pipeline",
+ *     roleNames: [
+ *         "viewer",
+ *         "catalog_viewer",
+ *     ],
+ * });
+ * export const ciApiKeyToken = ci.token;
+ * // Rotating is asked for by changing token_version - conventionally by incrementing it.
+ * // That's the change Terraform can see, since the token itself is invisible to a plan.
+ * // The previous token keeps working for rotation_grace_period_minutes, giving whatever
+ * // holds it a window to pick up the new one.
+ * const rotatedQuarterly = new incident.ApiKey("rotated_quarterly", {
+ *     name: "Terraform state reader",
+ *     roleNames: ["viewer"],
+ *     tokenVersion: 2,
+ *     rotationGracePeriodMinutes: 60,
+ * });
+ * // A key can be scoped to particular teams instead of the whole account. team_ids says
+ * // which teams, and team_role_names says what the key may do for them, so the two go
+ * // together: set both, or neither. An account with no account-level roles leaves
+ * // role_names out entirely.
+ * const platformTeamSchedules = new incident.ApiKey("platform_team_schedules", {
+ *     name: "Platform team schedule sync",
+ *     teamIds: ["01G0J1EXE7AXZ2C93K61WBPYEH"],
+ *     teamRoleNames: [
+ *         "schedules_editor",
+ *         "on_call_editor",
+ *     ],
+ * });
+ * // Editing a key's roles never rotates it: the token outlives its permissions. Rotate
+ * // deliberately if narrowing a key's scopes should also stop the old token being accepted.
+ * const narrowed = new incident.ApiKey("narrowed", {
+ *     name: "Read-only reporting key",
+ *     roleNames: ["viewer"],
+ *     tokenVersion: 3,
+ *     rotationGracePeriodMinutes: 0,
+ * });
+ * ```
+ *
+ * ## Import
+ *
+ * Import is supported using an `import` block or the `pulumi import` command:
+ *
+ * The `pulumi import` command can be used, for example:
+ *
+ * !/bin/bash
+ *
+ * Import an API key using its ID
+ * Replace the ID with a real ID from your incident.io organization
+ *
+ * ```sh
+ * $ pulumi import incident:index/apiKey:ApiKey example 01ABC123DEF456GHI789JKL
+ * ```
+ *
+ * An imported key has no token: the one it was issued with went to whoever created it and
+ * can't be read back, so `token` is null. It has no tokenVersion either, so a config that
+ * sets one will rotate the key on the first apply - which is also the only way to get a
+ * token for a key Terraform has adopted. The plan says so before it happens.
+ */
+class ApiKey extends pulumi.CustomResource {
+    /**
+     * Get an existing ApiKey resource's state with the given name, ID, and optional extra
+     * properties used to qualify the lookup.
+     *
+     * @param name The _unique_ name of the resulting resource.
+     * @param id The _unique_ provider ID of the resource to lookup.
+     * @param state Any extra arguments used during the lookup.
+     * @param opts Optional settings to control the behavior of the CustomResource.
+     */
+    static get(name, id, state, opts) {
+        return new ApiKey(name, state, { ...opts, id: id });
+    }
+    /** @internal */
+    static __pulumiType = 'incident:index/apiKey:ApiKey';
+    /**
+     * Returns true if the given object is an instance of ApiKey.  This is designed to work even
+     * when multiple copies of the Pulumi SDK have been loaded into the same process.
+     */
+    static isInstance(obj) {
+        if (obj === undefined || obj === null) {
+            return false;
+        }
+        return obj['__pulumiType'] === ApiKey.__pulumiType;
+    }
+    constructor(name, argsOrState, opts) {
+        let resourceInputs = {};
+        opts = opts || {};
+        if (opts.id) {
+            const state = argsOrState;
+            resourceInputs["comments"] = state?.comments;
+            resourceInputs["createdAt"] = state?.createdAt;
+            resourceInputs["lastUsedAt"] = state?.lastUsedAt;
+            resourceInputs["name"] = state?.name;
+            resourceInputs["roleNames"] = state?.roleNames;
+            resourceInputs["rotationGracePeriodMinutes"] = state?.rotationGracePeriodMinutes;
+            resourceInputs["teamIds"] = state?.teamIds;
+            resourceInputs["teamRoleNames"] = state?.teamRoleNames;
+            resourceInputs["token"] = state?.token;
+            resourceInputs["tokenLastIssuedAt"] = state?.tokenLastIssuedAt;
+            resourceInputs["tokenVersion"] = state?.tokenVersion;
+        }
+        else {
+            const args = argsOrState;
+            resourceInputs["comments"] = args?.comments;
+            resourceInputs["name"] = args?.name;
+            resourceInputs["roleNames"] = args?.roleNames;
+            resourceInputs["rotationGracePeriodMinutes"] = args?.rotationGracePeriodMinutes;
+            resourceInputs["teamIds"] = args?.teamIds;
+            resourceInputs["teamRoleNames"] = args?.teamRoleNames;
+            resourceInputs["tokenVersion"] = args?.tokenVersion;
+            resourceInputs["createdAt"] = undefined /*out*/;
+            resourceInputs["lastUsedAt"] = undefined /*out*/;
+            resourceInputs["token"] = undefined /*out*/;
+            resourceInputs["tokenLastIssuedAt"] = undefined /*out*/;
+        }
+        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
+        const secretOpts = { additionalSecretOutputs: ["token"] };
+        opts = pulumi.mergeOptions(opts, secretOpts);
+        super(ApiKey.__pulumiType, name, resourceInputs, opts);
+    }
+}
+exports.ApiKey = ApiKey;
+//# sourceMappingURL=apiKey.js.map

package/apiKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKey.js","sourceRoot":"","sources":["../apiKey.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AACzC,uDAAyC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoHG;AACH,MAAa,MAAO,SAAQ,MAAM,CAAC,cAAc;IAC7C;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAAmB,EAAE,IAAmC;QACjH,OAAO,IAAI,MAAM,CAAC,IAAI,EAAO,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,gBAAgB;IACT,MAAM,CAAU,YAAY,GAAG,8BAA8B,CAAC;IAErE;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC;IACvD,CAAC;IAyDD,YAAY,IAAY,EAAE,WAAsC,EAAE,IAAmC;QACjG,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAAsC,CAAC;YACrD,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,QAAQ,CAAC;YAC7C,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC;YAC/C,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,EAAE,UAAU,CAAC;YACjD,cAAc,CAAC,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC;YACrC,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC;YAC/C,cAAc,CAAC,4BAA4B,CAAC,GAAG,KAAK,EAAE,0BAA0B,CAAC;YACjF,cAAc,CAAC,SAAS,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC;YAC3C,cAAc,CAAC,eAAe,CAAC,GAAG,KAAK,EAAE,aAAa,CAAC;YACvD,cAAc,CAAC,OAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC;YACvC,cAAc,CAAC,mBAAmB,CAAC,GAAG,KAAK,EAAE,iBAAiB,CAAC;YAC/D,cAAc,CAAC,cAAc,CAAC,GAAG,KAAK,EAAE,YAAY,CAAC;SACxD;aAAM;YACH,MAAM,IAAI,GAAG,WAAqC,CAAC;YACnD,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC;YAC5C,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC;YAC9C,cAAc,CAAC,4BAA4B,CAAC,GAAG,IAAI,EAAE,0BAA0B,CAAC;YAChF,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,eAAe,CAAC,GAAG,IAAI,EAAE,aAAa,CAAC;YACtD,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YACpD,cAAc,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAChD,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACjD,cAAc,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5C,cAAc,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC3D;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,EAAE,uBAAuB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;;AArHL,wBAsHC"}