sazabi_sso_scim

Turns SCIM on for the organization’s SSO connection so your identity provider can add members, update them and remove the ones who leave. Creating it mints the SCIM token your identity provider sends as a bearer token. Destroying it turns SCIM off and revokes every SCIM token; members and their SCIM records are kept, but people who leave your identity provider are no longer removed automatically. If the SSO connection was replaced after Terraform turned SCIM on, destroying leaves the replacement connection’s SCIM on. The token is sensitive and write-once. Sazabi answers it only when it is minted, so Terraform never reads it back. Change rotation_trigger to rotate it: the new token replaces it in state, and the previous one keeps working for 24 hours so you can update your identity provider. If the token Terraform holds is revoked or expires outside Terraform, token becomes null and the next apply mints a new one. Creating it fails when SCIM is already on, because Terraform did not mint that token and cannot read it. Import it instead, turn SCIM off first, or leave it out of Terraform. It needs an owner’s key, or a secret key that can manage SSO.

Example

resource "sazabi_sso_scim" "example" {
  rotation_trigger = "2026-q4"
  depends_on       = [sazabi_sso_connection.example]
}

output "scim_token" {
  value     = sazabi_sso_scim.example.token
  sensitive = true
}

Arguments

Attribute	Type	Behavior	Description
`organization_id`	string	Optional, Computed	Owning organization. Defaults to the provider’s organization, then to the API key’s. Immutable.
`rotation_trigger`	string	Optional	Any value. Changing it mints a new token; the previous one works for 24 more hours. The first apply after import never rotates: any `rotation_trigger` in the configuration at that apply is recorded as the baseline, and `terraform plan` warns. After that first apply, changing `rotation_trigger` rotates as usual.
`token_expires_at`	string	Optional	When each token this resource mints stops working (RFC 3339, in the future). Unset means it never expires. Applies from the next minted token.
`id`	string	Computed	ID of the SSO connection SCIM is on for.
`token`	string	Computed, Sensitive	The SCIM bearer token. Write-once; null after import, and once it is no longer live.
`token_id`	string	Computed	ID of the token Terraform holds.
`token_prefix`	string	Computed	The token’s first characters, as the dashboard and CLI show it.
`enabled_at`	string	Computed	When SCIM was turned on.
`last_change_at`	string	Computed	When Sazabi last received a change from your identity provider.

Import

terraform import sazabi_sso_scim.example <organization_id>
terraform import sazabi_sso_scim.example -

- imports the API key’s own organization. Import fails when SCIM is off. Import holds the live token by its token_id and token_prefix but cannot read its value, so token stays null and Terraform warns you. Import never rotates the token: the plan after import is empty, and your identity provider keeps using the token it has. The first apply after import never rotates: any rotation_trigger in the configuration at that apply is recorded as the baseline, and terraform plan warns. After that first apply, changing rotation_trigger rotates as usual. If SCIM is on with no live token, the first apply mints one.

Overview

Get started

Guides

Catalogs

Reference

Security & trust

cve.now

sazabi_sso_scim

Example

Arguments

Import

​Example

​Arguments

​Import

Example

Arguments

Import