onyx_credential (Resource)

Connector credentials — the secret payload a connector authenticates with. Pair a credential with an onyx_connector to start indexing. The API always returns the payload masked, so the payload is never read back: Terraform cannot refresh it or detect changes made outside Terraform. Supply it as credential_json_wo to keep it out of Terraform state as well.

Example Usage

# Credentials hold the secret a connector authenticates with. Keep the values
# in variables or a secret store — never in version control.
resource "onyx_credential" "confluence" {
  source = "confluence"
  name   = "confluence-service-account"

  credential_json = jsonencode({
    confluence_username     = var.confluence_username
    confluence_access_token = var.confluence_access_token
  })
}

# The same credential with a write-only payload. Terraform sends it on every
# apply and stores none of it, so the secret never reaches a state file.
# Needs Terraform 1.11 or later.
resource "onyx_credential" "confluence_write_only" {
  source = "confluence"
  name   = "confluence-service-account-wo"

  credential_json_wo = jsonencode({
    confluence_username     = var.confluence_username
    confluence_access_token = var.confluence_access_token
  })

  # Terraform cannot diff a value it never stores. Raise this counter to make
  # the next apply send a rotated payload.
  credential_json_wo_version = 1
}

Schema

Required

• source (String) Connector source this credential belongs to, lowercase, e.g. confluence, google_drive, slack. Must match the source of the connector it is paired with.

Optional

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

• admin_public (Boolean) Whether every admin can use this credential. Onyx has no API to change it later. Leaving it true also keeps the credential readable: the API hides a private credential from admins other than its creator, and Terraform cannot tell that apart from a deleted one.
• credential_json (String, Sensitive) Secret payload as a JSON object, e.g. jsonencode({ confluence_username = "...", confluence_access_token = "..." }). The required keys depend on the source. Set exactly one of this and credential_json_wo, which keeps the payload out of state entirely.
• credential_json_wo (String, Sensitive, Write-only) Secret payload as a JSON object, held only in configuration. Terraform stores nothing, so the payload never reaches state. Pair it with credential_json_wo_version to rotate it. Needs Terraform 1.11 or later.
• credential_json_wo_version (Number) Rotation counter for credential_json_wo. Terraform never stores a write-only value and so cannot tell that the secret changed; raise this number to make the next apply send the current one. Do not derive it from the secret itself — unlike the secret, this number is kept in state.
• curator_public (Boolean) Whether curators of the assigned groups can use this credential. Create-only.
• groups (List of Number) Enterprise user-group ids allowed to use this credential. Create-only, and not returned by the API, so Terraform cannot detect changes made elsewhere.
• name (String) Display name. Onyx has no API to clear a name, so removing this attribute keeps the last value instead of planning a change.

Read-Only

• id (String) Numeric credential id.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

#!/bin/sh
# Import by numeric credential id. Onyx only returns the payload masked, so
# credential_json stays at its configured value and is never refreshed.
terraform import onyx_credential.confluence 12