Uptimeify Docs
Resources

uptimeify_sso_oidc

Single sign-on of the organization with an OpenID Connect identity provider (PUT /api/organization/sso). One per organization; needs an organization admin token. Saving runs the issuer's discovery, so the issuer must be reachable over HTTPS from Uptimeify. Register the client at your identity provider with redirect_uri and the scopes (both known before the first apply, see GET /api/organization/sso). Prove the domain with the DNS TXT record verification_record and uptimeify_sso_domain_verification. A new domain or issuer resets the verification, the first login and enforce_sso. Destroying it removes SSO. A SAML configuration is not managed here: it reads as gone, and an apply replaces it with OIDC. Import with the id sso.

Single sign-on of the organization with an OpenID Connect identity provider (PUT /api/organization/sso). One per organization; needs an organization admin token. Saving runs the issuer's discovery, so the issuer must be reachable over HTTPS from Uptimeify.

Register the client at your identity provider with redirect_uri and the scopes (both known before the first apply, see GET /api/organization/sso). Prove the domain with the DNS TXT record verification_record and uptimeify_sso_domain_verification. A new domain or issuer resets the verification, the first login and enforce_sso.

Destroying it removes SSO. A SAML configuration is not managed here: it reads as gone, and an apply replaces it with OIDC. Import with the id sso.

Example Usage

variable "oidc_client_secret" {
  type      = string
  sensitive = true
}

# Register the client at your identity provider first, with
# uptimeify_sso_oidc.corp.redirect_uri and the scopes openid, email, profile.
resource "uptimeify_sso_oidc" "corp" {
  issuer                   = "https://login.example.com/realms/corp"
  client_id                = "uptimeify"
  client_secret_wo         = var.oidc_client_secret
  client_secret_wo_version = 1
  domain                   = "example.com"
  default_role             = "editor"
  # enforce_sso = true  # only after the domain is verified and one SSO login worked
}

Schema

Required

  • client_id (String)
  • domain (String) Lowercase email domain of the users who sign in with SSO, e.g. example.com. One organization per domain.
  • issuer (String) Issuer URL, https://, without trailing slash (the discovery document's issuer must match).

Optional

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

  • client_secret_wo (String, Sensitive, Write-only) Write-only client secret; required for the first save. Sent with create and whenever client_secret_wo_version changes; never stored in state. Removing it keeps the stored secret.
  • client_secret_wo_version (Number) Change to resend client_secret_wo.
  • default_role (String) Role of users created by their first SSO login: readonly, editor, responder or admin. Defaults to readonly.
  • enforce_sso (Boolean) Only SSO (no password login) for users of domain. Needs a verified domain and one completed SSO login (can_enforce), else the apply fails with 409 ssoEnforceNotAllowed. Defaults to false.

Read-Only

  • can_enforce (Boolean) Whether enforce_sso may be switched on: domain verified and one SSO login done.
  • domain_verified (Boolean) Whether the TXT record was verified (see uptimeify_sso_domain_verification).
  • id (String) Always sso.
  • redirect_uri (String) Redirect (callback) URI to register at the identity provider.
  • scopes (List of String) Scopes Uptimeify requests at login (fixed: openid, email, profile).
  • verification_record (Attributes) DNS TXT record that proves control of domain; publish it with your DNS provider. (see below for nested schema)

Nested Schema for verification_record

Read-Only:

  • name (String) Name of the TXT record, _uptimeify-sso.<domain>.
  • value (String) Value of the TXT record.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# Always the id sso (one SSO configuration per organization)
terraform import uptimeify_sso_oidc.corp sso

uptimeify_sso_domain_verification

Verifies the SSO domain's DNS TXT record once (POST /api/organization/sso/verify-domain). Create fails with the expected and the found TXT values when the record is not visible yet; publish uptimeify_sso_oidc.verification_record and apply again. There is no waiting or retrying. Needs an organization admin token. Set domain = uptimeify_sso_oidc.<name>.domain, so a new domain verifies again in the same apply. A new issuer also resets the verification: the next plan shows this resource again. Destroying it changes nothing in Uptimeify. Import with the id sso.

uptimeify_status_page

A status page of one customer, or of the whole organization without customer_id. It shows its explicit components (uptimeify_status_page_component, the allowlist) and, only with include_customer_monitors, also every monitor of the customer except hidden_monitors. Design, audience groups, custom domain and IM rules are separate resources (uptimeify_status_page_design, uptimeify_status_page_audience_groups, uptimeify_status_page_domain, uptimeify_im_statuspage_rule). Deleting the page also deletes its custom domain. Import with the numeric id or the public id.

On this page

Example UsageSchemaRequiredOptionalRead-OnlyNested Schema for verification_recordImport