Contact Us 1-800-596-4880
  1. Homepage
  2. MuleSoft Terraform Provider
  3. Resources

  4. Access Management Resources

Access Management Resources

Use Access Management resources to manage organizations, environments, connected applications, roles, and teams in Anypoint Platform.

Access Management resources use a connected-app (client_credentials) token, which must have the appropriate org-level permissions. Only the anypoint_organization and anypoint_environment resources require user credentials (auth_type = "user").

anypoint_connected_app

Use the anypoint_connected_app resource to create and manage Anypoint Connected Applications for programmatic access to Anypoint Platform APIs.

A connected app can act on behalf of a user (authorization_code, password, or urn:ietf:params:oauth:grant-type:jwt-bearer grant types) or on its own behalf (client_credentials grant type).

Connected App: This resource requires a standard connected app (client credentials) with the appropriate org-level permissions. An admin connected app isn’t needed.

Use the inline scopes attribute on this resource to manage connected app scopes. The anypoint_connected_app_scopes resource is deprecated.

Example Usage

Connected app acting on its own behalf (client credentials)

resource "anypoint_connected_app" "example" {
  name        = "Automation App"
  grant_types = ["client_credentials"]

  scopes = [
    {
      scope          = "Mule Developer Generative AI User"
      context_params = { org = var.org_id }
    },
    {
      scope          = "Read Applications"
      context_params = { org = var.org_id, envId = var.env_id }
    },
    {
      scope          = "Exchange Viewer"
      context_params = { org = var.org_id }
    },
  ]
}

Connected app acting on behalf of a user

resource "anypoint_connected_app" "user_behalf" {
  name          = "User App"
  grant_types   = ["authorization_code"]
  redirect_uris = ["https://app.example.com/callback"]
  client_uri    = "https://app.example.com"
  audience      = "internal"
}

Required Arguments

  • name - The name of the connected app.

  • grant_types - (List of String) OAuth grant types. Valid values: authorization_code, password, urn:ietf:params:oauth:grant-type:jwt-bearer (act on behalf of a user), or client_credentials (act on its own behalf).

Optional Arguments

  • audience - Whether the app is visible to members of this org only (internal) or all Anypoint users (everyone). Defaults to internal.

  • client_uri - Website URL. Required for user-behalf apps to be editable in the Anypoint UI.

  • enabled - Whether the connected app is enabled. Defaults to true.

  • organization_id - The organization ID. If not specified, uses the organization from provider credentials.

  • public_keys - (List of String) Public keys for the JWT Bearer grant type.

  • redirect_uris - (List of String) OAuth redirect URIs. Required for user-behalf apps to be editable in the Anypoint UI.

  • scopes - (Attributes Set) Scopes assigned to the app. When set, this list is authoritative. Scopes assigned outside of Terraform are removed on the next apply. Omit to leave scopes unmanaged. Supplying = [] removes all user-assigned scopes. See Nested Schema for scopes.

The platform automatically assigns an undeletable profile scope to every connected app. It doesn’t appear in this set and must not be listed. The provider ignores it so that a plan run right after an apply reports no changes.

Read-Only Attributes

  • id - The client_id of the connected app.

  • client_secret - (Sensitive) The client secret. Only returned on creation and not retrievable after import.

  • created_at - Timestamp when the app was created.

  • owner_user_id - The user ID of the app owner.

  • updated_at - Timestamp when the app was last updated.

Nested Schema for scopes

  • scope - (Required) The scope display name as shown in the Anypoint UI (for example, Read Applications, Exchange Viewer). Use the anypoint_available_scopes data source to discover valid values. Scope identifiers (for example, read:applications) are also accepted.

  • context_params - (Map of String) Context parameters. For client_credentials apps, org is required on every scope; add envId for environment-scoped scopes. User-behalf apps ignore context_params. Missing org on a client_credentials scope causes a 400 error at apply time and can leave the app in an inconsistent state with credentials outside Terraform state.

Import a Connected App

An existing connected app can be imported using its client_id, or a composite {org_id}:{client_id}.

client_secret isn’t available after import (only returned on creation).

 
import {
  to = anypoint_connected_app.imported
  id = "<client_id>"
}

resource "anypoint_connected_app" "imported" {
  name        = "<app_name>"
  grant_types = ["client_credentials"]
}

After adding the import block, run:

# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply

Using the CLI (deprecated, Terraform < 1.5)

# Using client_id only:
terraform import anypoint_connected_app.imported <client_id>

# Using org_id and client_id:
terraform import anypoint_connected_app.imported <org_id>:<client_id>

anypoint_connected_app_scopes

anypoint_connected_app_scopes is deprecated. Use the inline scopes attribute on anypoint_connected_app instead, which manages scopes as part of the app resource in a single apply.

Use the anypoint_connected_app_scopes resource to manage scopes for an existing connected application in Anypoint Platform.

Connected App: This resource requires a standard connected app (client credentials) with the appropriate org-level permissions. An admin connected app isn’t needed.

Example Usage

resource "anypoint_connected_app_scopes" "example" {
  connected_app_id = "my-connected-app-id"

  scopes = [
    {
      scope = "admin:cloudhub"
      context_params = {
        org = "your-org-id"
      }
    },
    {
      scope = "read:applications"
      context_params = {
        org   = "your-org-id"
        envId = "your-env-id"
      }
    }
  ]
}

Required Arguments

  • connected_app_id - The ID of the connected application to manage scopes for.

  • scopes - (Block Set) The set of scopes to assign to the connected application. See Nested Schema for scopes.

Read-Only Attributes

  • id - The unique identifier for the connected app scopes (same as connected_app_id).

Nested Schema for scopes

  • scope - (Required) The scope name (for example, admin:cloudhub, read:applications).

  • context_params - (Map of String) Context parameters for the scope (for example, organization ID).

Import

An existing connected app’s scopes can be imported using the connected app ID (UUID).

import {
  to = anypoint_connected_app_scopes.imported
  id = "<connected_app_id>"
}

resource "anypoint_connected_app_scopes" "imported" {
  connected_app_id = "<connected_app_id>"
  scopes           = []
}

After adding the import block, run:

# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply

Using the CLI (deprecated, Terraform < 1.5)

terraform import anypoint_connected_app_scopes.imported <connected_app_id>

anypoint_environment

Use the anypoint_environment resource to manage Anypoint Platform environments.

Admin provider required: This resource requires the anypoint.admin provider configured with auth_type = "user" (user credentials + connected app client credentials).

Example Usage

provider "anypoint" {
  alias         = "admin"
  auth_type     = "user"
  client_id     = var.anypoint_admin_client_id
  client_secret = var.anypoint_admin_client_secret
  username      = var.anypoint_admin_username
  password      = var.anypoint_admin_password
  base_url      = var.anypoint_base_url
}

resource "anypoint_environment" "example" {
  provider        = anypoint.admin
  name            = "my-sandbox-env"
  type            = "sandbox"
  is_production   = false
  organization_id = "your-org-id"
}

Required Arguments

  • name - The name of the environment.

Optional Arguments

  • organization_id - Organization ID where the environment will be created. If not provided, the organization ID is inferred from the connected app credentials.

  • type - The type of the environment (design, sandbox, production). Defaults to sandbox.

  • is_production - Whether this is a production environment. Defaults to false.

  • arc_namespace - The ARC namespace for the environment.

  • client_id - The client ID associated with the environment.

Read-Only Attributes

  • id - The unique identifier for the environment.

Import

An existing environment can be imported using its environment ID (UUID).

import {
  to = anypoint_environment.imported
  id = "<environment_id>"
}

resource "anypoint_environment" "imported" {
  provider        = anypoint.admin
  organization_id = "<organization_id>"
  name            = "<environment_name>"
  type            = "sandbox"
}

After adding the import block, run:

# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply

Using the CLI (deprecated, Terraform < 1.5)

terraform import anypoint_environment.imported <environment_id>

anypoint_organization

Use the anypoint_organization resource to create and manage Anypoint Platform organizations (business groups).

Admin provider required: This resource requires the anypoint.admin provider configured with auth_type = "user" (user credentials + connected app client credentials).

Entitlement State Behaviour

The provider honours user-defined state for entitlements, not platform defaults.

  • Fields you declare are managed by Terraform — any platform-side change will be reverted on the next apply.

  • Fields you omit are unmanaged. Platform-side updates to those fields aren’t reflected in the plan and won’t be reverted.

  • Master-org-only entitlements (hybrid, omni_gateway, service_mesh, worker_logging_override, runtime_fabric, design_center) are inherited on sub-orgs and can’t be set via this resource on a business group. They are stripped from API requests to prevent HTTP 403 errors.

Only declare entitlement fields you want Terraform to own. Leave everything else out of your config.

Example Usage

provider "anypoint" {
  alias         = "admin"
  auth_type     = "user"
  client_id     = var.anypoint_admin_client_id
  client_secret = var.anypoint_admin_client_secret
  username      = var.anypoint_admin_username
  password      = var.anypoint_admin_password
  base_url      = var.anypoint_base_url
}

resource "anypoint_organization" "example" {
  provider = anypoint.admin

  name                   = "my-sub-org"
  parent_organization_id = "parent-org-id"
  owner_id               = "owner-user-id"

  entitlements = {
    create_sub_orgs     = false
    create_environments = true
    global_deployment   = false

    vcores_production = { assigned = 0 }
    vcores_sandbox    = { assigned = 0 }
    vcores_design     = { assigned = 0 }
    vpcs              = { assigned = 0 }
    network_connections   = { assigned = 0 }
    managed_gateway_small = { assigned = 0 }
    managed_gateway_large = { assigned = 0 }
  }
}

Required Arguments

  • name - The name of the organization.

  • owner_id - The ID of the organization owner. Changing this forces a new resource.

  • parent_organization_id - The ID of the parent organization. Changing this forces a new resource.

Optional Arguments

Read-Only Attributes

  • id - The unique identifier for the organization.

  • client_id - The client ID associated with the organization.

  • created_at - The creation timestamp of the organization.

  • deleted_at - The deletion timestamp of the organization.

  • domain - The domain of the organization.

  • environments - (Block List) The environments within the organization.

  • gdot_id - The GDOT ID of the organization.

  • idprovider_id - The ID provider ID for the organization.

  • is_automatic_admin_promotion_exempt - Whether the organization is exempt from automatic admin promotion.

  • is_federated - Whether the organization is federated.

  • is_master - Whether the organization is a master organization.

  • is_root - Whether the organization is a root organization.

  • mfa_required - Whether MFA is required for the organization.

  • org_type - The type of the organization.

  • parent_organization_ids - List of parent organization IDs (ancestor chain).

  • session_timeout - The session timeout for the organization.

  • sub_organization_ids - List of sub-organization IDs.

  • subscription - (Block) The subscription details for the organization.

  • tenant_organization_ids - List of tenant organization IDs.

  • updated_at - The last update timestamp of the organization.

Nested Schema for entitlements

Only the fields you declare are managed by Terraform. Fields you omit aren’t tracked and won’t be reverted if the platform changes them.

  • create_environments - Whether environments can be created. Defaults to false.

  • create_sub_orgs - Whether sub-organizations can be created. Defaults to false.

  • global_deployment - Whether global deployment is enabled. Defaults to false.

  • runtime_fabric - Whether Runtime Fabric is enabled. Master-org-only — ignored on business groups.

  • design_center - (Block) Design Center entitlement. Master-org-only — ignored on business groups.

    • api - Whether API Designer is enabled.

    • mozart - Whether Flow Designer (Mozart) is enabled.

  • omni_gateway - (Block) Omni Gateway entitlement. Master-org-only — ignored on business groups.

    • enabled - Whether this feature is enabled.

  • hybrid - (Block) Hybrid entitlement. Master-org-only — ignored on business groups.

    • enabled - Whether this feature is enabled.

  • service_mesh - (Block) Service Mesh entitlement. Master-org-only — ignored on business groups.

    • enabled - Whether this feature is enabled.

  • worker_logging_override - (Block) Worker logging override entitlement. Master-org-only — ignored on business groups.

    • enabled - Whether this feature is enabled.

  • vcores_production - (Block) Production vCore entitlement.

    • assigned - Number of assigned units. Defaults to 0.

    • reassigned - Number of reassigned units. Defaults to 0.

  • vcores_sandbox - (Block) Sandbox vCore entitlement.

    • assigned - Number of assigned units. Defaults to 0.

    • reassigned - Number of reassigned units. Defaults to 0.

  • vcores_design - (Block) Design vCore entitlement.

    • assigned - Number of assigned units. Defaults to 0.

    • reassigned - Number of reassigned units. Defaults to 0.

  • vpcs - (Block) VPC entitlement.

    • assigned - Number of assigned units. Defaults to 0.

    • reassigned - Number of reassigned units. Defaults to 0.

  • network_connections - (Block) Network connections entitlement.

    • assigned - Number of assigned units. Defaults to 0.

    • reassigned - Number of reassigned units. Defaults to 0.

  • gateways - (Block) Gateways entitlement.

    • assigned - Number of assigned units.

  • load_balancer - (Block) Load balancer entitlement.

    • assigned - Number of assigned units.

  • managed_gateway_small - (Block) Managed Gateway (small) entitlement.

    • assigned - Number of assigned units.

  • managed_gateway_large - (Block) Managed Gateway (large) entitlement.

    • assigned - Number of assigned units.

  • mq_messages - (Block) MQ messages entitlement.

    • base - Base number of MQ units. Defaults to 0.

    • add_on - Add-on number of MQ units. Defaults to 0.

  • mq_requests - (Block) MQ requests entitlement.

    • base - Base number of MQ units. Defaults to 0.

    • add_on - Add-on number of MQ units. Defaults to 0.

static_ips and vpns entitlements are managed server-side by Anypoint and aren’t settable via Terraform. Configure them through the Anypoint UI or API.

Nested Schema for environments

When a new organization is created, Anypoint Platform automatically provisions two environments: Sandbox and Production. These appear in the environments read-only attribute after the first apply and don’t need to be declared in your configuration.

  • id - The environment ID. (Read-Only)

  • name - The environment name. (Read-Only)

  • organization_id - The organization ID. (Read-Only)

  • client_id - The environment client ID. (Read-Only)

  • type - The environment type. (Read-Only)

  • is_production - Whether the environment is a production environment. (Read-Only)

  • arc_namespace - The ARC namespace of the environment. (Optional)

Nested Schema for subscription

  • category - The subscription category. (Read-Only)

  • type - The subscription type. (Read-Only)

  • expiration - The subscription expiration date. (Read-Only)

  • justification - The subscription justification. (Optional)

Import

An existing organization can be imported using its organization ID (UUID). Your HCL must declare name, parent_organization_id, and owner_id before importing — those are required attributes. The first terraform plan after import refreshes all read-only and optional attributes (including entitlements) from the Anypoint API.

parent_organization_id is derived from the server-returned ancestor chain (parent_organization_ids) on the first refresh. If the derivation doesn’t match what you wrote in HCL, update the HCL to match — changing parent_organization_id triggers a destroy+recreate.

import {
  to = anypoint_organization.imported
  id = "<organization_id>"
}

resource "anypoint_organization" "imported" {
  provider               = anypoint.admin
  name                   = "<org_name>"
  parent_organization_id = "<parent_org_id>"
  owner_id               = "<owner_user_id>"
}

After adding the import block, run:

# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply

Using the CLI (deprecated, Terraform < 1.5)

terraform import anypoint_organization.imported <organization_id>

anypoint_role

Use the anypoint_role resource to manage Anypoint Platform role groups (custom or default), including their inline permission assignments and member list.

Connected App: This resource requires a standard connected app (client credentials) with the appropriate org-level permissions. The connected app must be granted Organization Administrator privileges.

Example Usage

resource "anypoint_role" "example" {
  name        = "API Developers"
  description = "Role group for the API development team"

  permissions = [
    {
      name = "Exchange Viewer"
      context_params = {
        org = var.organization_id
      }
    },
    {
      name = "Read Applications"
      context_params = {
        org   = var.organization_id
        envId = var.environment_id
      }
    },
  ]

  members = [
    "jdoe",
    "asmith",
  ]
}

Required Arguments

  • name - The name of the role group.

Optional Arguments

  • description - A description of the role group. Optional and computed. If you omit it, the server-resolved value is retained and won’t be wiped when you change other fields.

  • organization_id - The organization ID where the role group is created. If not specified, uses the organization from provider credentials.

  • permissions - (Attributes Set) The set of permissions granted by this role group. When set, this list is authoritative. Permissions not listed here are removed on apply. Omit to leave permissions unmanaged. Supplying = [] declares no managed permissions and removes any that exist. System (internal) assignments are never modified. See Nested Schema for permissions.

  • members - (Set of String) The set of usernames that are members of this role group. When set, this list is authoritative. Members not listed here are removed on apply. Omit to leave membership unmanaged. Usernames are case-insensitive. Use the anypoint_users data source to discover usernames.

Platform side-effect grants (for example, the auto-added org-scoped "Business Group Viewer") are never surfaced in state and never removed by Terraform.

Read-Only Attributes

  • id - The unique identifier for the role group.

  • created_at - Timestamp when the role group was created.

  • editable - Whether the role group can be edited. Default (system) role groups aren’t editable.

  • external_names - (List of String) External group names mapped to this role group (SSO/SAML).

  • updated_at - Timestamp when the role group was last updated.

Nested Schema for permissions

  • name - (Required) The permission display name as shown in the Anypoint UI (for example, Exchange Viewer). Case-insensitive. Use the anypoint_available_permissions data source to discover valid values.

  • context_params - (Map of String) Context parameters. Typically org (organization ID) and, for environment-scoped permissions, envId.

Import a Role Group

An existing role group can be imported using the role group ID (UUID).

import {
  to = anypoint_role.imported
  id = "<role_group_id>"
}

resource "anypoint_role" "imported" {
  name = "<role_name>"
}

After adding the import block, run:

# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply

Using the CLI (deprecated, Terraform < 1.5)

terraform import anypoint_role.imported <role_group_id>

anypoint_team

Use the anypoint_team resource to manage teams in Anypoint Platform, including their role assignments and member list.

Connected App: Creating a team, managing members, reads, and import work with a standard client_credentials connected app. Assigning most permissions requires auth_type = "user" — only Exchange Viewer, Exchange Administrator, and View Organization work with client credentials; others return 403 Forbidden.

Example Usage

provider "anypoint" {
  client_id     = var.anypoint_client_id
  client_secret = var.anypoint_client_secret
  base_url      = var.anypoint_base_url
}

data "anypoint_teams" "all" {}

locals {
  root_team_id = [for t in data.anypoint_teams.all.teams : t.id if t.is_root_team][0]
}

resource "anypoint_team" "example" {
  name           = "Development Team"
  team_type      = "internal"
  parent_team_id = local.root_team_id

  permissions = [
    {
      name = "Exchange Viewer"
      context_params = {
        org = var.organization_id
      }
    },
  ]

  members = [
    {
      username        = "jdoe"
      membership_type = "maintainer"
    },
    {
      username = "asmith"
    },
  ]
}

resource "anypoint_team" "sub_team" {
  name           = "Frontend Team"
  parent_team_id = anypoint_team.example.id
  team_type      = "internal"
}

Required Arguments

  • name - The name of the team.

Optional Arguments

  • organization_id - Organization ID where the team will be created. If not provided, the organization ID is inferred from connected app credentials.

  • parent_team_id - The ID of the parent team. If omitted, the org’s root team is used. Use the anypoint_teams data source to look up team IDs by name.

  • team_type - The type of team. Defaults to internal. Changing the type requires the target type to be enabled in the org.

  • members - (Attributes Set) Members of this team. When set, this list is authoritative. Members not listed are removed on apply. Omit to leave membership unmanaged. Members assigned via external groups (SAML/SCIM) are never modified. See Nested Schema for members.

  • permissions - (Attributes Set) Permissions assigned to this team. When set, this list is authoritative. Permissions not listed are removed on apply. Omit to leave permissions unmanaged. System (internal) assignments are never modified. See Nested Schema for permissions.

Read-Only Attributes

  • id - The unique identifier for the team.

  • created_at - The timestamp when the team was created.

  • updated_at - The timestamp when the team was last updated.

Nested Schema for permissions

  • name - (Required) The permission display name (for example, Exchange Viewer). Case-insensitive. Use the anypoint_available_permissions data source to discover valid values.

  • context_params - (Map of String) Context parameters. Typically org and, for environment-scoped permissions, envId.

Nested Schema for members

  • username - (Required) The username. Case-insensitive. Use the anypoint_users data source to discover usernames.

  • membership_type - The membership type: member (default) or maintainer. Maintainers can manage team membership and child teams.

Import

An existing team can be imported using its team ID (UUID).

import {
  to = anypoint_team.imported
  id = "<team_id>"
}

resource "anypoint_team" "imported" {
  organization_id = "<organization_id>"
  name            = "<team_name>"
  team_type       = "internal"
}

After adding the import block, run:

# Let Terraform generate the full resource configuration automatically:
terraform plan -generate-config-out=generated.tf

# Or apply the import directly if you have an existing resource block:
terraform apply

Using the CLI (deprecated, Terraform < 1.5)

terraform import anypoint_team.imported <team_id>

anypoint_available_permissions Data Source

Use the anypoint_available_permissions data source to list all permissions that can be assigned to role groups and teams.

Connected App: This data source requires a standard connected app (client credentials) with the appropriate org-level permissions. An admin connected app isn’t needed.

Example Usage

data "anypoint_available_permissions" "all" {}

data "anypoint_available_permissions" "read_apps" {
  name_filter = "Read Applications"
}

output "all_permission_names" {
  value = [for p in data.anypoint_available_permissions.all.permissions : p.name]
}

Optional Arguments

  • name_filter - (String) Case-insensitive substring match to filter permissions by name.

Read-Only Attributes

Nested Schema for permissions

  • role_id - The permission’s unique ID.

  • name - The permission display name. Use this value in anypoint_role permissions[].name and anypoint_team roles[].name.

  • description - A description of the permission.

anypoint_available_scopes Data Source

Use the anypoint_available_scopes data source to list all scopes available for connected apps.

Connected App: This data source requires a standard connected app (client credentials) with the appropriate org-level permissions. An admin connected app isn’t needed.

Example Usage

data "anypoint_available_scopes" "all" {}

data "anypoint_available_scopes" "with_internal" {
  include_internal = true
}

output "scope_display_names" {
  value = [for s in data.anypoint_available_scopes.all.scopes : s.display_name]
}

Optional Arguments

  • include_internal - (Boolean) Whether to include internal-only scopes. Defaults to false. Setting this to true changes the returned set of scopes, not just field visibility.

Read-Only Attributes

  • id - Static value "catalog". This data source isn’t org-scoped.

  • scopes - (List of Object) The list of available scopes. See Nested Schema for scopes.

Nested Schema for scopes

  • display_name - The scope display name. Use this value in anypoint_connected_app scopes[].scope.

  • scope - The scope identifier (for example, admin:cloudhub). Also accepted in scopes[].scope, but display names are preferred.

  • description - A description of the scope.

  • product_label - The product label for the scope.

  • internal - Whether this is an internal scope. Only visible when include_internal = true.

anypoint_connected_app Data Source

Use the anypoint_connected_app data source to read the configuration of a single connected app by ID.

Connected App: This data source requires a standard connected app (client credentials) with the appropriate org-level permissions. An admin connected app isn’t needed.

Example Usage

data "anypoint_connected_app" "example" {
  id = "abc123-def456-ghi789"
}

output "scopes" {
  value = data.anypoint_connected_app.example.scopes
}

Required Arguments

  • id - The client_id of the connected app.

Optional Arguments

  • organization_id - The organization ID. If not specified, uses the organization from provider credentials.

Read-Only Attributes

  • name - The name of the connected app.

  • grant_types - (List of String) OAuth grant types.

  • redirect_uris - (List of String) OAuth redirect URIs.

  • audience - The audience setting (internal or everyone).

  • client_uri - The website URL.

  • enabled - Whether the connected app is enabled.

  • owner_user_id - The user ID of the app owner.

  • scopes - (List of Object) The scopes assigned to the app. See Nested Schema for scopes.

  • created_at - Timestamp when the app was created.

  • updated_at - Timestamp when the app was last updated.

client_secret isn’t exposed by this data source (only returned on creation).

Nested Schema for scopes

  • scope - The scope display name or identifier.

  • context_params - (Map of String) Context parameters.

anypoint_connected_apps data source

Use the anypoint_connected_apps data source to list all connected apps in an org.

Connected App: This data source requires a standard connected app (client credentials) with the appropriate org-level permissions. An admin connected app isn’t needed.

Example Usage

data "anypoint_connected_apps" "all" {}

output "enabled_apps" {
  value = [for a in data.anypoint_connected_apps.all.apps : a if a.enabled]
}

Optional Arguments

  • organization_id - The organization ID. If not specified, uses the organization from provider credentials.

Read-Only Attributes

Nested Schema for apps

  • client_id - The client ID of the connected app.

  • name - The name of the connected app.

  • grant_types - (List of String) OAuth grant types.

  • audience - The audience setting.

  • client_uri - The website URL.

  • enabled - Whether the connected app is enabled.

  • owner_user_id - The user ID of the app owner.

  • created_at - Timestamp when the app was created.

  • updated_at - Timestamp when the app was last updated.

anypoint_role Data Source

Use the anypoint_role data source to read the configuration of a single role group by ID.

Connected App: This data source requires a standard connected app (client credentials) with the appropriate org-level permissions. An admin connected app isn’t needed.

Example Usage

data "anypoint_role" "example" {
  id = "12345678-1234-1234-1234-123456789abc"
}

output "role_permissions" {
  value = data.anypoint_role.example.permissions
}

output "role_members" {
  value = data.anypoint_role.example.members
}

Required Arguments

  • id - The role group ID (UUID).

Optional Arguments

  • organization_id - The organization ID. If not specified, uses the organization from provider credentials.

Read-Only Attributes

  • name - The name of the role group.

  • description - The description of the role group.

  • editable - Whether the role group can be edited.

  • external_names - (List of String) External group names mapped to this role group (SSO/SAML).

  • permissions - (List of Object) The permissions granted by this role group. Excludes system/internal assignments and platform side-effect grants. See Nested Schema for permissions.

  • members - (List of String) The usernames of members in this role group.

  • created_at - Timestamp when the role group was created.

  • updated_at - Timestamp when the role group was last updated.

Nested Schema for permissions

  • name - The permission display name.

  • context_params - (Map of String) Context parameters.

anypoint_roles Data Source

Use the anypoint_roles data source to list all role groups in an org.

Connected App: This data source requires a standard connected app (client credentials) with the appropriate org-level permissions. An admin connected app isn’t needed.

Example Usage

data "anypoint_roles" "all" {}

output "admin_role" {
  value = [for r in data.anypoint_roles.all.roles : r if r.name == "Organization Administrators"]
}

Optional Arguments

  • organization_id - The organization ID. If not specified, uses the organization from provider credentials.

Read-Only Attributes

Nested Schema for roles

  • id - The role group ID.

  • name - The name of the role group.

  • description - The description of the role group.

  • editable - Whether the role group can be edited.

  • external_names - (List of String) External group names mapped to this role group.

  • created_at - Timestamp when the role group was created.

  • updated_at - Timestamp when the role group was last updated.

anypoint_team Data Source

Use the anypoint_team data source to read the configuration of a single team by ID.

Connected App: Reads work with a standard client_credentials connected app. The same permission restriction applies as for the resource. Most permission assignments require auth_type = "user".

Example Usage

data "anypoint_team" "ops" {
  id              = "team-uuid-here"
  organization_id = var.organization_id
}

output "team_members" {
  value = data.anypoint_team.ops.members
}

Required Arguments

  • id - The team ID (UUID).

Optional Arguments

  • organization_id - The organization ID. If not specified, uses the organization from provider credentials.

Read-Only Attributes

  • name - The name of the team.

  • parent_team_id - The ID of the parent team. Null for the root team.

  • team_type - The type of team.

  • permissions - (Attributes List) Permissions assigned to this team. Excludes system/internal assignments. See Nested Schema for permissions.

  • members - (Attributes List) Members of this team. See Nested Schema for members.

  • created_at - Timestamp when the team was created.

  • updated_at - Timestamp when the team was last updated.

Nested Schema for permissions

  • name - The permission display name.

  • context_params - (Map of String) Context parameters.

Nested Schema for members

  • username - The username.

  • membership_type - The membership type (member or maintainer).

  • is_assigned_via_external_groups - Whether this member was assigned via an external group (SAML/SCIM).

anypoint_teams Data Source

Use the anypoint_teams data source to list all teams in an org, or filter by name.

Connected App: This data source requires a standard connected app (client credentials) with the appropriate org-level permissions. An admin connected app isn’t needed.

Example Usage

data "anypoint_teams" "all" {}

output "root_team_id" {
  value = [for t in data.anypoint_teams.all.teams : t.id if t.is_root_team][0]
}

data "anypoint_teams" "engineering" {
  name_filter = "Engineering"
}

resource "anypoint_team" "sub_team" {
  name           = "Sub Team"
  parent_team_id = data.anypoint_teams.engineering.teams[0].id
}

Optional Arguments

  • organization_id - The organization ID. If not specified, uses the organization from provider credentials.

  • name_filter - (String) Case-insensitive substring match to filter teams by name. If omitted, all teams are returned.

Read-Only Attributes

Nested Schema for teams

  • id - The team ID.

  • name - The name of the team.

  • team_type - The type of team.

  • ancestor_team_ids - (List of String) IDs of ancestor teams. Empty for the root team.

  • is_root_team - Whether this is the org’s root team. Use its id as parent_team_id for top-level teams.

  • created_at - Timestamp when the team was created.

  • updated_at - Timestamp when the team was last updated.

anypoint_users Data Source

Use the anypoint_users data source to list users in an org. Use it to discover usernames for the members attribute on anypoint_role and anypoint_team.

Connected App: This data source requires a standard connected app (client credentials) with the appropriate org-level permissions. An admin connected app isn’t needed.

Example Usage

data "anypoint_users" "all" {}

data "anypoint_users" "filtered" {
  name_filter = "john.doe"
}

output "user_id_by_email" {
  value = [for u in data.anypoint_users.all.users : u.id if u.email == "john.doe@example.com"][0]
}

Optional Arguments

  • organization_id - The organization ID. If not specified, uses the organization from provider credentials.

  • name_filter - (String) Case-insensitive substring match across username, email, first name, and last name.

Read-Only Attributes

Nested Schema for users

  • id - The user ID.

  • username - The username. Use this value in anypoint_role members and anypoint_team members[].username.

  • first_name - The user’s first name.

  • last_name - The user’s last name.

  • email - The user’s email address.

  • enabled - Whether the user account is enabled.