onyx_user_group (Resource)

A user group: a roster of people, the managers among them, and the permissions the group grants. Enterprise Edition only — the routes do not exist on Community Edition, where every call answers 404.

Permissions in Onyx come only from group grants, so this resource is how a person gets any authority at all.

What the group can see is not set here. Connectors, document sets, agents, LLM providers, MCP servers and credentials each carry their own groups attribute, and they own that link. This resource reads those back but never writes them, so the two sides cannot fight over the same edge.

Example Usage

terraform

# A group with nothing but a name. Members can be added later, from here or
# from the admin panel — but note the configuration wins on the next apply.
resource "onyx_user_group" "everyone_uk" {
  name = "UK"
}

# A team that administers connectors and document sets, with two of its members
# managing the roster.
#
# Permissions use Onyx's own tokens, not the enum names. Only toggleable ones
# can be set: `basic`, `admin`, `craft_sandbox` and `manage:skills` are managed
# by Onyx and are refused here.
resource "onyx_user_group" "data_platform" {
  name = "Data Platform"

  user_ids = [
    "3f6c1e2a-0b4d-4c8e-9a1f-2d5b7c9e0a13",
    "8d2b5f71-6c3a-4e19-b0d7-1a4f8c2e5b60",
    "c1a94e08-7f2d-4b63-8e15-9d0c3a6f4b27",
  ]

  # Every manager must also appear in user_ids: Onyx stores the flag on the
  # membership row, so a manager is always a member.
  manager_ids = [
    "3f6c1e2a-0b4d-4c8e-9a1f-2d5b7c9e0a13",
    "8d2b5f71-6c3a-4e19-b0d7-1a4f8c2e5b60",
  ]

  permissions = [
    "manage:connectors",
    "manage:document_sets",
    "read:query_history",
  ]
}

# What a group can see is set from the other side. The connector owns this
# link, so the group never fights it for the same edge.
resource "onyx_cc_pair" "sales_drive" {
  name          = "Sales Drive"
  connector_id  = onyx_connector.drive.id
  credential_id = onyx_credential.drive.id
  access_type   = "private"
  groups        = [onyx_user_group.data_platform.id]
}

Schema

Required

name (String) Group name, unique across the deployment. Renaming is a separate call that Onyx refuses while the group is syncing, so the provider waits first.

Optional

incognito_enabled (Boolean) Whether members may start incognito chats. Only takes effect while the deployment restricts incognito access to groups, but it is always storable so a roster can be staged before the mode is flipped. Writing it needs full admin access, so the provider only calls the endpoint when it changes.
manager_ids (Set of String) User ids that manage the group. Every manager must also appear in user_ids — Onyx stores the flag on the membership row, so a manager is always a member.
permissions (Set of String) Permission grants, written as Onyx's own tokens: manage:connectors, manage:document_sets, manage:llms, manage:actions, manage:agents, add:agents, manage:user_groups, manage:bots, manage:service_account_api_keys, create:user_api_keys, read:agent_analytics, read:query_history. Note these are the wire values, not the enum names.

The configuration owns the list, so leaving it out revokes every grant the group has.

Only toggleable permissions may be set. Onyx manages the rest itself (basic, admin, craft_sandbox, manage:skills and the implied read tokens); they are neither read back here nor writable, and naming one is refused. Writing this attribute needs full admin access, so the provider only calls the endpoint when the set actually changes.

timeouts (Block, Optional) (see below for nested schema)
user_ids (Set of String) Member user ids (UUIDs). The configuration owns this list: leaving it out empties the group.

Onyx refuses a removal that would leave someone in no group at all, because a person with no group has no permissions and would keep a login that can do nothing.

Read-Only

cc_pair_ids (Set of String) Connector-credential pairs shared with this group. Read-only here: onyx_cc_pair owns the link through its own groups attribute.
document_set_ids (Set of String) Document sets shared with this group. Read-only here: onyx_document_set owns the link.
id (String) Group id, assigned by Onyx.
is_default (Boolean) Whether this is one of the seeded system groups (Admin, Basic). A default group holds members and nothing else: Onyx refuses to rename it, delete it, or change its permissions or incognito setting. Importing one and managing its roster works; anything else fails at apply time.
persona_ids (Set of String) Agents shared with this group. Read-only here: onyx_persona owns the link.

Nested Schema for `timeouts`

Optional:

delete (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
update (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

shell

#!/bin/sh
# Import by numeric group id.
#
# The seeded Admin and Basic groups can be imported and their rosters managed,
# but Onyx refuses to rename or delete one, or to change its permissions.
terraform import onyx_user_group.data_platform 4

generated by https://github.com/hashicorp/terraform-plugin-docs