Quickstart

For an invited trial, use the minimal trial settings workflow. It imports existing settings and requires a separate organization read/write key.

Prerequisites

• Pulumi CLI >= 3
• Tenant identifier (for example acme)
• Org-level API key for control-plane API access (recommended for CI/CD)

Node.js example

npm install @pulumi/pulumi @atensec/pulumi-thoth@0.1.16

import * as pulumi from "@pulumi/pulumi";
import * as thoth from "@atensec/pulumi-thoth";
 
const cfg = new pulumi.Config();
 
const provider = new thoth.Provider("thoth", {
  tenantId: cfg.require("tenantId"),
  apiBaseUrl: cfg.require("govapiBaseUrl"),
  orgApiKeyFile: cfg.require("orgApiKeyFile"),
});
 
new thoth.governance.GovernanceSettings(
  "baseline",
  {
    shadowLow: "allow",
    shadowMedium: "step_up",
    shadowHigh: "block",
    shadowCritical: "block",
  },
  { provider }
);
 
new thoth.governance.WebhookSettings(
  "baseline-webhook",
  {
    webhookEnabled: true,
    webhookUrl: cfg.require("webhookUrl"),
    webhookSecret: cfg.requireSecret("webhookSecret"),
  },
  { provider }
);

Python example

pip install pulumi pulumi-thoth==0.1.16

import pulumi
import pulumi_thoth as thoth
 
config = pulumi.Config()
 
provider = thoth.Provider(
    "thoth",
    tenant_id=config.require("tenantId"),
    api_base_url=config.require("govapiBaseUrl"),
    org_api_key_file=config.require("orgApiKeyFile"),
)

When apiBaseUrl is omitted, the provider derives:

https://grid.<tenant_id>.<apex_domain>

adminBearerToken and adminBearerTokenFile remain available for bearer-token workflows. THOTH_API_KEY is also supported as an environment-variable auth fallback and must be org-scoped with read/write permissions. THOTH_TENANT_ID is supported as a tenant fallback when tenantId/tenant_id is omitted.

Minimal env-only provider configuration:

const provider = new thoth.Provider("thoth", {});

Review changes safely

These examples describe supported provider APIs; they do not create a trial. Import existing singleton settings before changing them. Review the plan or preview and keep state, plans, and keys private. Deleting a settings resource does not restore prior values; apply the saved prior configuration to undo a change. Only configure integrations enabled for your environment. The trial settings guide gives the minimal import workflow without webhook or compliance-profile configuration.