keenauth_management_client

The keenauth_management_client resource sets the management API access of an application with app_type = "management": the permissions and the IP allowlist with which the application's machine-to-machine client may call the management API. An application has at most one record, and the record is identified by the application ID.

Least privilege

This resource grants access to the management API. Keep it narrow:

List only the permissions the automation needs, for example users:read rather than every users:* permission.
Restrict allowed_cidrs to the networks the client runs in.
Use one management application per automation, so that each one can be narrowed or removed on its own.

The API key that applies the configuration can grant only permissions and networks that it has itself.

resource "keenauth_application" "ops" {
  key      = "ops-automation"
  name     = "Ops automation"
  app_type = "management"
  party    = "first_party"
}

resource "keenauth_management_client" "ops" {
  application_id = keenauth_application.ops.id
  permissions    = ["users:read", "applications:read"]
  allowed_cidrs  = ["203.0.113.0/24"]
}

Signing keys

The resource holds no secret and no key. Register the application's public key with POST /v1/applications/{application_id}/credentials (type: public_key) in the CLI or the dashboard. The API rejects jwks_uri and public_keys on this resource.

`allowed_cidrs` in the plan

If you omit allowed_cidrs when the record is created, the API writes the calling API key's own list. When the key has no list, the client has no IP restriction. The plan shows (known after apply).
Once the record exists, omitting the attribute keeps the current value. Removing it from the configuration does not reset the list, and a change made outside the configuration is accepted without a diff. Write the list explicitly to manage it.
An empty list is rejected at plan time, because the API turns [] into the calling key's list. Omit the attribute instead.
Write each block in canonical form: the network address, and lower-case IPv6. For example write 10.0.0.0/24, not 10.0.0.5/24.

Errors

Error	Meaning
`403 insufficient_permissions`	Only an API key can manage these records; use a provider configured with `api_key`, not `client_id` + `private_key`. With an API key, a restricted key is missing `management-clients:read` or `management-clients:write`.
`403 permission_escalation`	The record would have permissions or networks that the API key does not have.
`404` on create	The application does not exist in the environment of the API key.
`409`	The application already has a record. Import it.
`422` on `application_id`	The application is not of type `management`.
`412`	The record changed after the plan. Nothing was changed; run `plan` again.

Import

Import by application ID:

tofu import keenauth_management_client.ops app_01j9zq3v8c5m2x7k4t6r1n0b3d