# keenauth_organization_domain

The `keenauth_organization_domain` resource adds a domain to an organization. A verified domain lets users with an e-mail address in it join the organization and routes their sign-in to the organization's SSO connection.

```terraform
resource "keenauth_organization_domain" "acme" {
  organization_id = keenauth_organization.acme.id
  domain          = "acme.example.com"
}

output "txt_record" {
  value = {
    name  = keenauth_organization_domain.acme.txt_record_name
    value = keenauth_organization_domain.acme.txt_record_value
  }
}
```

## Verification

- A `dns_txt` domain (the default) starts `pending`. Publish `txt_record_name` with the value `txt_record_value` as a TXT record at your DNS provider. The platform checks it on a schedule; to check at once, run `keenauth organization-domains verify <id>`.
- A domain not verified within 72 hours becomes `expired`. Run `keenauth organization-domains verify <id>` to start again; this issues a new `txt_record_value`.
- If the TXT record of a verified domain disappears, the domain becomes `unverified`, and `revoked` after 30 days.
- Verification is an action, not an attribute. The provider never runs it; it only reads `status`.
- `verification_method = "manual"` is your declaration that you own the domain. The domain is `verified` at once and the declaration is written to the management audit log.
- The TXT value is a public DNS value, not a secret. It is kept in state so that a DNS resource can use it.

## Capture and SSO routing

- `capture_mode` is `off` (default), `suggest` or `auto_join`. `sso_routing_enabled` routes e-mail addresses in the domain to the organization's SSO connection.
- Both can be turned on only on a `verified` domain; the API answers `409 domain_not_verified` otherwise. Turning them off is always allowed.
- For a new `dns_txt` domain, keep the defaults: the plan fails if you turn them on before the domain exists. Create the domain, publish the record, wait until `status` is `verified`, then set them and apply again.

## Lifecycle

- Write `domain` in lower case without a trailing dot. Write internationalized names as A-labels (`xn--…`).
- Changing `organization_id`, `domain` or `verification_method` replaces the domain and starts a new verification.
- Removing the resource deletes the domain; capture and SSO routing stop with it.
- Deleting the organization deletes its domains. A domain deleted outside the provider is removed from state and planned again.

## Import

Import by ID or by `<org_id>/<domain>`:

```shell
tofu import keenauth_organization_domain.acme odm_01j9zq3v8c5m2x7k4t6r1n0b3d
tofu import keenauth_organization_domain.acme org_01j9zq3v8c5m2x7k4t6r1n0b3d/acme.example.com
```