onyx_credential (Resource)

Connector credentials — the secret payload a connector authenticates with. Pair a credential with an onyx_connector to start indexing. The API always returns the payload masked, so credential_json is write-only: Terraform never refreshes it and cannot detect changes made outside Terraform.

Example Usage

# Credentials hold the secret a connector authenticates with. Keep the values
# in variables or a secret store — never in version control.
resource "onyx_credential" "confluence" {
  source = "confluence"
  name   = "confluence-service-account"

  credential_json = jsonencode({
    confluence_username     = var.confluence_username
    confluence_access_token = var.confluence_access_token
  })
}

Schema

Required

• credential_json (String, Sensitive) Secret payload as a JSON object, e.g. jsonencode({ confluence_username = "...", confluence_access_token = "..." }). The required keys depend on the source.
• source (String) Connector source this credential belongs to, lowercase, e.g. confluence, google_drive, slack. Must match the source of the connector it is paired with.

Optional

• admin_public (Boolean) Whether every admin can use this credential. Onyx has no API to change it later. Leaving it true also keeps the credential readable: the API hides a private credential from admins other than its creator, and Terraform cannot tell that apart from a deleted one.
• curator_public (Boolean) Whether curators of the assigned groups can use this credential. Create-only.
• groups (List of Number) Enterprise user-group ids allowed to use this credential. Create-only, and not returned by the API, so Terraform cannot detect changes made elsewhere.
• name (String) Display name. Onyx has no API to clear a name, so removing this attribute keeps the last value instead of planning a change.

Read-Only

• id (String) Numeric credential id.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

#!/bin/sh
# Import by numeric credential id. Onyx only returns the payload masked, so
# credential_json stays at its configured value and is never refreshed.
terraform import onyx_credential.confluence 12