# Quickstart

> Install and configure the Thoth Pulumi provider.

Source: https://docs.atensecurity.com/docs/pulumi-provider/quickstart

For an invited trial, use the minimal
[trial settings workflow](https://docs.atensecurity.com/docs/getting-started/trial-settings). It imports
existing settings and requires a separate organization read/write key.

## Prerequisites

- Pulumi CLI `>= 3`
- Tenant identifier (for example `acme`)
- Org-level API key for control-plane API access (recommended for CI/CD)

## Node.js example

```bash title="Terminal"
npm install @pulumi/pulumi @atensec/pulumi-thoth@0.1.16
```

```typescript title="index.ts"
import * as pulumi from "@pulumi/pulumi";
import * as thoth from "@atensec/pulumi-thoth";

const cfg = new pulumi.Config();

const provider = new thoth.Provider("thoth", {
  tenantId: cfg.require("tenantId"),
  apiBaseUrl: cfg.require("govapiBaseUrl"),
  orgApiKeyFile: cfg.require("orgApiKeyFile"),
});

new thoth.governance.GovernanceSettings(
  "baseline",
  {
    shadowLow: "allow",
    shadowMedium: "step_up",
    shadowHigh: "block",
    shadowCritical: "block",
  },
  { provider }
);

new thoth.governance.WebhookSettings(
  "baseline-webhook",
  {
    webhookEnabled: true,
    webhookUrl: cfg.require("webhookUrl"),
    webhookSecret: cfg.requireSecret("webhookSecret"),
  },
  { provider }
);
```

## Python example

```bash title="Terminal"
pip install pulumi pulumi-thoth==0.1.16
```

```python title="__main__.py"
import pulumi
import pulumi_thoth as thoth

config = pulumi.Config()

provider = thoth.Provider(
    "thoth",
    tenant_id=config.require("tenantId"),
    api_base_url=config.require("govapiBaseUrl"),
    org_api_key_file=config.require("orgApiKeyFile"),
)
```

When `apiBaseUrl` is omitted, the provider derives:

`https://grid.<tenant_id>.<apex_domain>`

`adminBearerToken` and `adminBearerTokenFile` remain available for bearer-token workflows.
`THOTH_API_KEY` is also supported as an environment-variable auth fallback and must be org-scoped with read/write permissions.
`THOTH_TENANT_ID` is supported as a tenant fallback when `tenantId`/`tenant_id` is omitted.

Minimal env-only provider configuration:

```typescript title="index.ts"
const provider = new thoth.Provider("thoth", {});
```

## Review changes safely

These examples describe supported provider APIs; they do not create a trial.
Import existing singleton settings before changing them. Review the plan or
preview and keep state, plans, and keys private. Deleting a settings resource
does not restore prior values; apply the saved prior configuration to undo a
change. Only configure integrations enabled for your environment. The
[trial settings guide](https://docs.atensecurity.com/docs/getting-started/trial-settings) gives the minimal