published on Friday, May 8, 2026 by Pulumi
published on Friday, May 8, 2026 by Pulumi
Manages a SCIM API token for a dbt Cloud account. SCIM tokens are used by identity providers (e.g. Okta, Azure AD) to provision and deprovision users and groups automatically.
The token value is only available immediately after creation and is stored in Terraform state as a sensitive value. It cannot be retrieved from the API afterwards.
Requires the SCIM feature to be enabled on the account (enterprise plans only).
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as dbtcloud from "@pulumi/dbtcloud";
// Create a SCIM token to allow an identity provider (e.g. Okta, Azure AD) to
// provision and deprovision users and groups in dbt Cloud.
//
// The token value is returned only on creation and stored in Terraform state
// as a sensitive value. It is never returned by subsequent API reads, so
// changing the `name` forces a new token to be created.
const okta = new dbtcloud.ScimConfigToken("okta", {name: "okta-scim"});
export const scimToken = okta.tokenString;
import pulumi
import pulumi_dbtcloud as dbtcloud
# Create a SCIM token to allow an identity provider (e.g. Okta, Azure AD) to
# provision and deprovision users and groups in dbt Cloud.
#
# The token value is returned only on creation and stored in Terraform state
# as a sensitive value. It is never returned by subsequent API reads, so
# changing the `name` forces a new token to be created.
okta = dbtcloud.ScimConfigToken("okta", name="okta-scim")
pulumi.export("scimToken", okta.token_string)
package main
import (
"github.com/pulumi/pulumi-dbtcloud/sdk/go/dbtcloud"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// Create a SCIM token to allow an identity provider (e.g. Okta, Azure AD) to
// provision and deprovision users and groups in dbt Cloud.
//
// The token value is returned only on creation and stored in Terraform state
// as a sensitive value. It is never returned by subsequent API reads, so
// changing the `name` forces a new token to be created.
okta, err := dbtcloud.NewScimConfigToken(ctx, "okta", &dbtcloud.ScimConfigTokenArgs{
Name: pulumi.String("okta-scim"),
})
if err != nil {
return err
}
ctx.Export("scimToken", okta.TokenString)
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using DbtCloud = Pulumi.DbtCloud;
return await Deployment.RunAsync(() =>
{
// Create a SCIM token to allow an identity provider (e.g. Okta, Azure AD) to
// provision and deprovision users and groups in dbt Cloud.
//
// The token value is returned only on creation and stored in Terraform state
// as a sensitive value. It is never returned by subsequent API reads, so
// changing the `name` forces a new token to be created.
var okta = new DbtCloud.Index.ScimConfigToken("okta", new()
{
Name = "okta-scim",
});
return new Dictionary<string, object?>
{
["scimToken"] = okta.TokenString,
};
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.dbtcloud.ScimConfigToken;
import com.pulumi.dbtcloud.ScimConfigTokenArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
// Create a SCIM token to allow an identity provider (e.g. Okta, Azure AD) to
// provision and deprovision users and groups in dbt Cloud.
//
// The token value is returned only on creation and stored in Terraform state
// as a sensitive value. It is never returned by subsequent API reads, so
// changing the `name` forces a new token to be created.
var okta = new ScimConfigToken("okta", ScimConfigTokenArgs.builder()
.name("okta-scim")
.build());
ctx.export("scimToken", okta.tokenString());
}
}
resources:
# Create a SCIM token to allow an identity provider (e.g. Okta, Azure AD) to
# provision and deprovision users and groups in dbt Cloud.
#
# The token value is returned only on creation and stored in Terraform state
# as a sensitive value. It is never returned by subsequent API reads, so
# changing the `name` forces a new token to be created.
okta:
type: dbtcloud:ScimConfigToken
properties:
name: okta-scim
outputs:
# The token string can be passed to other resources or outputs.
# Mark outputs as sensitive when exposing the token value.
scimToken: ${okta.tokenString}
Create ScimConfigToken Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new ScimConfigToken(name: string, args?: ScimConfigTokenArgs, opts?: CustomResourceOptions);@overload
def ScimConfigToken(resource_name: str,
args: Optional[ScimConfigTokenArgs] = None,
opts: Optional[ResourceOptions] = None)
@overload
def ScimConfigToken(resource_name: str,
opts: Optional[ResourceOptions] = None,
name: Optional[str] = None)func NewScimConfigToken(ctx *Context, name string, args *ScimConfigTokenArgs, opts ...ResourceOption) (*ScimConfigToken, error)public ScimConfigToken(string name, ScimConfigTokenArgs? args = null, CustomResourceOptions? opts = null)
public ScimConfigToken(String name, ScimConfigTokenArgs args)
public ScimConfigToken(String name, ScimConfigTokenArgs args, CustomResourceOptions options)
type: dbtcloud:ScimConfigToken
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args ScimConfigTokenArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args ScimConfigTokenArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args ScimConfigTokenArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args ScimConfigTokenArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args ScimConfigTokenArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var scimConfigTokenResource = new DbtCloud.ScimConfigToken("scimConfigTokenResource", new()
{
Name = "string",
});
example, err := dbtcloud.NewScimConfigToken(ctx, "scimConfigTokenResource", &dbtcloud.ScimConfigTokenArgs{
Name: pulumi.String("string"),
})
var scimConfigTokenResource = new ScimConfigToken("scimConfigTokenResource", ScimConfigTokenArgs.builder()
.name("string")
.build());
scim_config_token_resource = dbtcloud.ScimConfigToken("scimConfigTokenResource", name="string")
const scimConfigTokenResource = new dbtcloud.ScimConfigToken("scimConfigTokenResource", {name: "string"});
type: dbtcloud:ScimConfigToken
properties:
name: string
ScimConfigToken Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The ScimConfigToken resource accepts the following input properties:
- Name string
- A human-readable name for the token. Changing this value forces a new token to be created.
- Name string
- A human-readable name for the token. Changing this value forces a new token to be created.
- name String
- A human-readable name for the token. Changing this value forces a new token to be created.
- name string
- A human-readable name for the token. Changing this value forces a new token to be created.
- name str
- A human-readable name for the token. Changing this value forces a new token to be created.
- name String
- A human-readable name for the token. Changing this value forces a new token to be created.
Outputs
All input properties are implicitly available as output properties. Additionally, the ScimConfigToken resource produces the following output properties:
- Created
At string - Timestamp when the token was created.
- Id string
- The provider-assigned unique ID for this managed resource.
- Last
Used string - Timestamp when the token was last used. Null if never used.
- Token
String string - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
- Created
At string - Timestamp when the token was created.
- Id string
- The provider-assigned unique ID for this managed resource.
- Last
Used string - Timestamp when the token was last used. Null if never used.
- Token
String string - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
- created
At String - Timestamp when the token was created.
- id String
- The provider-assigned unique ID for this managed resource.
- last
Used String - Timestamp when the token was last used. Null if never used.
- token
String String - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
- created
At string - Timestamp when the token was created.
- id string
- The provider-assigned unique ID for this managed resource.
- last
Used string - Timestamp when the token was last used. Null if never used.
- token
String string - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
- created_
at str - Timestamp when the token was created.
- id str
- The provider-assigned unique ID for this managed resource.
- last_
used str - Timestamp when the token was last used. Null if never used.
- token_
string str - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
- created
At String - Timestamp when the token was created.
- id String
- The provider-assigned unique ID for this managed resource.
- last
Used String - Timestamp when the token was last used. Null if never used.
- token
String String - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
Look up Existing ScimConfigToken Resource
Get an existing ScimConfigToken resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: ScimConfigTokenState, opts?: CustomResourceOptions): ScimConfigToken@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
created_at: Optional[str] = None,
last_used: Optional[str] = None,
name: Optional[str] = None,
token_string: Optional[str] = None) -> ScimConfigTokenfunc GetScimConfigToken(ctx *Context, name string, id IDInput, state *ScimConfigTokenState, opts ...ResourceOption) (*ScimConfigToken, error)public static ScimConfigToken Get(string name, Input<string> id, ScimConfigTokenState? state, CustomResourceOptions? opts = null)public static ScimConfigToken get(String name, Output<String> id, ScimConfigTokenState state, CustomResourceOptions options)resources: _: type: dbtcloud:ScimConfigToken get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Created
At string - Timestamp when the token was created.
- Last
Used string - Timestamp when the token was last used. Null if never used.
- Name string
- A human-readable name for the token. Changing this value forces a new token to be created.
- Token
String string - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
- Created
At string - Timestamp when the token was created.
- Last
Used string - Timestamp when the token was last used. Null if never used.
- Name string
- A human-readable name for the token. Changing this value forces a new token to be created.
- Token
String string - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
- created
At String - Timestamp when the token was created.
- last
Used String - Timestamp when the token was last used. Null if never used.
- name String
- A human-readable name for the token. Changing this value forces a new token to be created.
- token
String String - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
- created
At string - Timestamp when the token was created.
- last
Used string - Timestamp when the token was last used. Null if never used.
- name string
- A human-readable name for the token. Changing this value forces a new token to be created.
- token
String string - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
- created_
at str - Timestamp when the token was created.
- last_
used str - Timestamp when the token was last used. Null if never used.
- name str
- A human-readable name for the token. Changing this value forces a new token to be created.
- token_
string str - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
- created
At String - Timestamp when the token was created.
- last
Used String - Timestamp when the token was last used. Null if never used.
- name String
- A human-readable name for the token. Changing this value forces a new token to be created.
- token
String String - The SCIM token value. Only available immediately after creation — not returned by subsequent API reads. Store this value securely.
Import
Import a SCIM config token by its numeric ID. Note: tokenString will be empty after import — the API never returns the token value after creation. This is expected and documented behaviour.
$ pulumi import dbtcloud:index/scimConfigToken:ScimConfigToken okta 12345
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- dbtcloud pulumi/pulumi-dbtcloud
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
dbtcloudTerraform Provider.
published on Friday, May 8, 2026 by Pulumi
