Quickstart

For an invited trial, use the minimal trial settings workflow. It imports existing settings and requires a separate organization read/write key.

Prerequisites

• Terraform >= 1.5
• Tenant identifier (for example acme)
• Org-level API key for control-plane API access (recommended for CI/CD)

Install provider

terraform {
  required_version = ">= 1.5"
 
  required_providers {
    thoth = {
      source  = "atensecurity/thoth"
      version = "~> 0.1.16"
    }
  }
}

Configure provider

provider "thoth" {
  tenant_id        = var.tenant_id
  api_base_url     = var.govapi_base_url
  org_api_key_file = var.org_api_key_file
}

When api_base_url is omitted, the provider derives:

https://grid.<tenant_id>.<apex_domain>

For a trial, use the supplied GovAPI base URL explicitly. Keep it separate from the SDK runtime endpoint.

API key file alternative

Use org_api_key_file instead of placing values directly in HCL:

provider "thoth" {
  tenant_id        = var.tenant_id
  org_api_key_file = pathexpand("~/.thoth/org-api-key.txt")
}

Environment variable alternative

You can export THOTH_API_KEY and omit provider auth fields:

export THOTH_API_KEY="aten_thoth_<env>_<token>"
export THOTH_TENANT_ID="acme"

THOTH_API_KEY must be an org-scoped key with read/write permissions. THOTH_TENANT_ID is used when tenant_id is omitted.

provider "thoth" {}

Bearer token compatibility

admin_bearer_token and admin_bearer_token_file remain supported for interactive/admin session workflows. Configure either bearer token auth or org API key auth.

Minimal resource example

resource "thoth_governance_settings" "baseline" {
  shadow_low         = "allow"
  shadow_medium      = "step_up"
  shadow_high        = "block"
  shadow_critical    = "block"
}

Related

• Resources and Data Sources
• Provider example configuration

Review changes safely

These examples describe supported provider APIs; they do not create a trial. Import existing singleton settings before changing them. Review the plan or preview and keep state, plans, and keys private. Deleting a settings resource does not restore prior values; apply the saved prior configuration to undo a change. Only configure integrations enabled for your environment. The trial settings guide gives the minimal import workflow without webhook or compliance-profile configuration.