# keenauth_management_client

The `keenauth_management_client` resource sets the management API access of an application with `app_type = "management"`: the permissions and the IP allowlist with which the application's machine-to-machine client may call the management API. An application has at most one record, and the record is identified by the application ID.

## Least privilege

This resource grants access to the management API. Keep it narrow:

- List only the permissions the automation needs, for example `users:read` rather than every `users:*` permission.
- Restrict `allowed_cidrs` to the networks the client runs in.
- Use one management application per automation, so that each one can be narrowed or removed on its own.

The API key that applies the configuration can grant only permissions and networks that it has itself.

```terraform
resource "keenauth_application" "ops" {
  key      = "ops-automation"
  name     = "Ops automation"
  app_type = "management"
  party    = "first_party"
}

resource "keenauth_management_client" "ops" {
  application_id = keenauth_application.ops.id
  permissions    = ["users:read", "applications:read"]
  allowed_cidrs  = ["203.0.113.0/24"]
}
```

## Signing keys

The resource holds no secret and no key. Register the application's public key with `POST /v1/applications/{application_id}/credentials` (`type: public_key`) in the CLI or the dashboard. The API rejects `jwks_uri` and `public_keys` on this resource.

## `allowed_cidrs` in the plan

- If you omit `allowed_cidrs` when the record is created, the API writes the calling API key's own list. When the key has no list, the client has no IP restriction. The plan shows `(known after apply)`.
- Once the record exists, omitting the attribute keeps the current value. Removing it from the configuration does not reset the list, and a change made outside the configuration is accepted without a diff. Write the list explicitly to manage it.
- An empty list is rejected at plan time, because the API turns `[]` into the calling key's list. Omit the attribute instead.
- Write each block in canonical form: the network address, and lower-case IPv6. For example write `10.0.0.0/24`, not `10.0.0.5/24`.

## Errors

| Error | Meaning |
|---|---|
| `403 insufficient_permissions` | Only an API key can manage these records; use a provider configured with `api_key`, not `client_id` + `private_key`. With an API key, a restricted key is missing `management-clients:read` or `management-clients:write`. |
| `403 permission_escalation` | The record would have permissions or networks that the API key does not have. |
| `404` on create | The application does not exist in the environment of the API key. |
| `409` | The application already has a record. Import it. |
| `422` on `application_id` | The application is not of type `management`. |
| `412` | The record changed after the plan. Nothing was changed; run `plan` again. |

## Import

Import by application ID:

```shell
tofu import keenauth_management_client.ops app_01j9zq3v8c5m2x7k4t6r1n0b3d
```