intutic_workspace_settings Cloud

The workspace's governance settings, written through PUT /api/v1/workspace/settings. Declare one per workspace. Terraform manages only the keys you set: each top-level key is compared and written whole (the API replaces it whole), except featureFlags, which is managed flag by flag. Keys you do not set are never sent, so values set in the dashboard or by another tool are left alone. Removing a key from the configuration stops managing it and leaves its value in place; destroying the resource changes nothing in the workspace. Spend caps are not settings and are not managed here: a workspace that has not saved a daily cap is held to $100 a day; set caps on Settings › Billing › Budget Limits or with PUT /api/v1/budget. Needs an OWNER or ADMIN key.

Example Usage

resource "intutic_workspace_settings" "this" {
  settings = jsonencode({
    egressMode         = "enforce"
    egressAllow        = ["api.github.com", "registry.npmjs.org"]
    mcpDefaultPolicy   = "deny"
    sandboxRequirement = "warn"
    ssoKeyMaxIdleDays  = 30
    piiDetectors = {
      "pii.card"  = "block"
      "pii.email" = "redact"
    }
    upstreamRetry = {
      maxAttempts = 4
      fallbacks = {
        "claude-opus-4-1" = [{ model = "claude-sonnet-4-5" }]
      }
    }
    featureFlags = {
      ff_shadow_enforcement = true
    }
  })
}

Schema

Required

• settings (String) A JSON object of the settings to manage, usually jsonencode({ ... }). Keys and value shapes are those of the settings API; an unknown key fails the plan. Write values the way the API stores them (bandit keywords in lower case, for example), or the next plan shows the stored form as a change. Every key, its values and bounds, and the feature flags are listed in Workspace Settings.

Read-Only

• id (String) The workspace id.

Import

# Import by workspace id (the provider key's workspace). The imported resource
# manages no keys until the configuration names some.
terraform import intutic_workspace_settings.this ws_0123456789abcdef