--- title: "Get Schema" method: GET path: "/api/v1/terraform-export/schema" tags: ["Terraform Export"] --- # Get Schema `GET /api/v1/terraform-export/schema` GetSchema returns the field-by-field Terraform mapping for one C1 API object type. Cacheable by (object_fqn, block_kind, provider_version). ## Response `200` Successful response - C1ApiTerraformExportV1GetSchemaResponse — The GetSchemaResponse message. - `schema` C1ApiTerraformExportV1TFSchemaMapping — TFSchemaMapping describes how to translate one C1 API object into a single Terraform block. Variant-specific metadata (e.g. `import_id` for resources) lives on the `block` oneof. This message contains a oneof named block. Only a single field of the following list may be set at a time: - resource - dataSource - `dataSource` C1ApiTerraformExportV1TFSchemaMappingDataSource, nullable — Data-source-specific schema metadata. Reserved for future use; empty in v1. - `fields` C1ApiTerraformExportV1TFFieldMapping[], nullable — Per-attribute mapping. Order matches the provider schema; preserve it when emitting for stable output. - `c1Field` string — The C1 API field name (proto field name, snake_case). - `computed` boolean — Whether the server populates this field. A field that is `computed` and neither `optional` nor `required` is server-only — do not emit it in user-authored HCL. - `elementTfType` 'TF_TYPE_UNSPECIFIED' | 'TF_TYPE_STRING' | 'TF_TYPE_NUMBER' | 'TF_TYPE_BOOL' | 'TF_TYPE_LIST' | 'TF_TYPE_SET' | 'TF_TYPE_MAP' | 'TF_TYPE_OBJECT' | 'TF_TYPE_TUPLE' — For collection fields (list/set/tuple/map) whose elements are primitives (string/number/bool), the TF type of those elements. TF_TYPE_UNSPECIFIED for non-collection fields and for collections of objects (where `nested_fields` describes the element shape). - `enumValues` C1ApiTerraformExportV1EnumValue[], nullable — Declared variants for fields whose C1-side proto type is an enum. Empty for non-enum fields. The conductorone provider accepts the full proto enum name as a quoted string (e.g. `policy_type = "POLICY_TYPE_GRANT"`); emit `EnumValue.name` as the literal value. - `name` string — Full proto enum value name (e.g. "POLICY_TYPE_GRANT"). The conductorone provider accepts this verbatim as a quoted-string HCL literal. - `number` integer — Proto enum number — the value on the wire (e.g. 1 for POLICY_TYPE_GRANT). - `nestedFields` C1ApiTerraformExportV1TFFieldMapping[], nullable — For object-typed fields and list/set/tuple fields whose elements are objects, the shape of the nested attributes. Empty for primitive scalars and primitive-element collections. - `oneofField` string — When this Terraform attribute corresponds to one variant of a proto `oneof`, `oneof_field` names the proto oneof and `oneof_variant` names the active case. Both unset for regular (non-oneof) fields, which is the common case. Example: a oneof `target` with variant `automation` on message `Action` exposed as the TF attribute `action_target_automation`: oneof_field = "target" oneof_variant = "automation" - `oneofVariant` string — The oneofVariant field. - `optional` boolean — Whether the user may supply this field. May co-occur with `computed` (i.e. either the user or the server can set the value). - `references` C1ApiTerraformExportV1TFReference — TFReference describes the Terraform type(s) an ID-shaped field may reference, plus any sibling fields needed to disambiguate a composite-key lookup. `tf_type_names` covers the polymorphic / preferred-default dimension. `composite_key_fields` covers the multi-key dimension — some referents can't be resolved with a single id (every `conductorone_app_entitlement` lookup needs `(app_id, id)`, every `conductorone_app_entitlement_user_binding` needs three keys, etc.). - `compositeKeyFields` C1ApiTerraformExportV1CompositeKeyField[], nullable — Sibling fields on the SAME parent message whose runtime values must be paired with this reference's id to look the referent up via its Terraform data source. Examples (each entry's c1_field is the C1 proto field name on the parent message; tf_field is the attribute name in the data source's `refs[]` struct): `AppEntitlementAutomation.app_entitlement_id` → `[{c1_field: "app_id", tf_field: "app_id"}]` (2 keys total) `AppEntitlementUserBinding.app_user_id` → `[{c1_field: "app_id", tf_field: "app_id"}, {c1_field: "app_entitlement_id", tf_field: "app_entitlement_id"}]` (3 keys total) `AppResourceOwner.user_id` → `[{c1_field: "app_id", tf_field: "app_id"}, {c1_field: "app_resource_type_id", tf_field: "app_resource_type_id"}, {c1_field: "app_resource_id", tf_field: "app_resource_id"}]` (4 keys total) The reference id field itself is always emitted as `id` in the data source's ref struct (provider convention) — it is NOT re-listed here. Empty/unset means single-id lookup is sufficient (User, Policy, App today). Mirrors `ImportIDShape.Composite.fields`'s structured shape. - `c1Field` string — C1 API field name on the parent message (snake_case proto field). The collector reads the runtime value at this path. - `tfField` string — Attribute name in the Terraform data source's `refs[]` struct. Usually identical to c1_field (the conductorone provider matches them 1:1 today). Distinct fields anyway so a future provider rename is wire-safe — no migration needed. - `tfTypeNames` string[], nullable — Candidate Terraform types this field may reference. The first entry is the preferred default when no other signal disambiguates. Empty means the field is not a reference. - `required` boolean — Whether the user must supply this field in HCL. - `sensitive` boolean — Whether the value is a secret. Sensitive values must not be rendered verbatim; emit a placeholder so callers wire the value through a Terraform variable or vault data source. - `tfField` string — The Terraform attribute name. Usually matches c1_field but may differ in casing or pluralization. - `tfType` 'TF_TYPE_UNSPECIFIED' | 'TF_TYPE_STRING' | 'TF_TYPE_NUMBER' | 'TF_TYPE_BOOL' | 'TF_TYPE_LIST' | 'TF_TYPE_SET' | 'TF_TYPE_MAP' | 'TF_TYPE_OBJECT' | 'TF_TYPE_TUPLE' — The Terraform attribute type. For collections of structured objects, the element shape is in `nested_fields`. For collections of primitives, the element type is in `element_tf_type`. - `providerVersion` string — The conductorone provider version this schema was derived from (e.g. "1.0.40"). - `refererShapes` C1ApiTerraformExportV1CompositeKeyFieldSet[], nullable — The set of distinct composite-key-field shapes that consumers declare when referencing this target via a TFReference. Used by the FE multi-root producer to enumerate canonical lookup keys for its `addressByImportId` registration so cross-root references collapse correctly to direct expressions regardless of which consumer site does the lookup. Each entry is one distinct shape (one `CompositeKeyFieldSet` with non-empty `fields`). The single-id (bare-id) form is implicit and is NOT represented here — every producer registers under `canonicalRefKey(id, {})` unconditionally as a baseline. Computed at schema-load time from `references_table.go` by grouping consumer-site `composite_key_fields` declarations by target tf_type and de-duplicating distinct shapes. Targets with no composite-key consumers (User, Policy, App today) ship an empty list. - `fields` C1ApiTerraformExportV1CompositeKeyField[], nullable — The fields field. - `c1Field` string — C1 API field name on the parent message (snake_case proto field). The collector reads the runtime value at this path. - `tfField` string — Attribute name in the Terraform data source's `refs[]` struct. Usually identical to c1_field (the conductorone provider matches them 1:1 today). Distinct fields anyway so a future provider rename is wire-safe — no migration needed. - `resource` C1ApiTerraformExportV1TFSchemaMappingResource, nullable — Resource-specific schema metadata. - `importId` C1ApiTerraformExportV1ImportIDShape — ImportIDShape describes the structure of the `id` value in a Terraform `import { to = ..., id = "..." }` block. Most resources use a single string; binding-style resources (App_Owner, App_Entitlement_Owner, …) use a composite of multiple field values. This message contains a oneof named shape. Only a single field of the following list may be set at a time: - singleString - composite - `composite` C1ApiTerraformExportV1ImportIDShapeComposite, nullable — Composite import IDs combine values from multiple component fields per the declared `format`. - `fields` C1ApiTerraformExportV1ImportIDShapeCompositeField[], nullable — Component fields, in the order they participate in the import ID. - `c1Field` string — The C1 API field whose value supplies this component. - `tfType` 'TF_TYPE_UNSPECIFIED' | 'TF_TYPE_STRING' | 'TF_TYPE_NUMBER' | 'TF_TYPE_BOOL' | 'TF_TYPE_LIST' | 'TF_TYPE_SET' | 'TF_TYPE_MAP' | 'TF_TYPE_OBJECT' | 'TF_TYPE_TUPLE' — The TF attribute type of the component value. - `format` 'FORMAT_JSON_OBJECT' | 'FORMAT_COLON_SEPARATED' | 'FORMAT_UNDERSCORE_SEPARATED' — Wire format the provider expects. Defaults to FORMAT_JSON_OBJECT. - `singleString` C1ApiTerraformExportV1ImportIDShapeSingleString, nullable — Single-string import IDs use the resource's id value verbatim. - `tfTypeName` string — The Terraform type identifier — the string immediately after the `resource` or `data` keyword in HCL (e.g. "conductorone_app"). --- [API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/d391405a35d3/schema)