# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from . import _utilities

__all__ = ['ScopedTokenArgs', 'ScopedToken']

@pulumi.input_type
class ScopedTokenArgs:
    def __init__(__self__, *,
                 audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 description: Optional[pulumi.Input[str]] = None,
                 expires_in: Optional[pulumi.Input[int]] = None,
                 grant_type: Optional[pulumi.Input[str]] = None,
                 include_reference_token: Optional[pulumi.Input[bool]] = None,
                 project_key: Optional[pulumi.Input[str]] = None,
                 refreshable: Optional[pulumi.Input[bool]] = None,
                 scopes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 username: Optional[pulumi.Input[str]] = None):
        """
        The set of arguments for constructing a ScopedToken resource.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] audiences: A list of the other instances or services that should accept this token identified by their Service-IDs. Limited to
               total 255 characters. Default to '*@*' if not set. Service ID must begin with valid JFrog service type. Options: jfrt,
               jfxr, jfpip, jfds, jfmc, jfac, jfevt, jfmd, jfcon, or *. For instructions to retrieve the Artifactory Service ID see
               this [documentation](https://jfrog.com/help/r/jfrog-rest-apis/get-service-id)
        :param pulumi.Input[str] description: Free text token description. Useful for filtering and managing tokens. Limited to 1024 characters.
        :param pulumi.Input[int] expires_in: The amount of time, in seconds, it would take for the token to expire. An admin shall be able to set whether expiry is
               mandatory, what is the default expiry, and what is the maximum expiry allowed. Must be non-negative. Default value is
               based on configuration in 'access.config.yaml'. See [API
               documentation](https://jfrog.com/help/r/jfrog-rest-apis/revoke-token-by-id) for details. Access Token would not be saved
               by Artifactory if this is less than the persistence threshold value (default to 10800 seconds) set in Access
               configuration. See [official
               documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/persistency-threshold) for details.
        :param pulumi.Input[str] grant_type: The grant type used to authenticate the request. In this case, the only value supported is `client_credentials` which is
               also the default value if this parameter is not specified.
        :param pulumi.Input[bool] include_reference_token: Also create a reference token which can be used like an API key. Default is `false`.
        :param pulumi.Input[str] project_key: The project for which this token is created. Enter the project name on which you want to apply this token.
        :param pulumi.Input[bool] refreshable: Is this token refreshable? Default is `false`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] scopes: The scope of access that the token provides. Access to the REST API is always provided by default. Administrators can
               set any scope, while non-admin users can only set the scope to a subset of the groups to which they belong. The
               supported scopes include: * `applied-permissions/user` - provides user access. If left at the default setting, the token
               will be created with the user-identity scope, which allows users to identify themselves in the Platform but does not
               grant any specific access permissions.* `applied-permissions/admin` - the scope assigned to admin users.*
               `applied-permissions/groups` - this scope assigns permissions to groups using the following format:
               applied-permissions/groups:<group-name>[,<group-name>...]* `system:metrics:r` - for getting the service metrics*
               `system:livelogs:r` - for getting the service livelogsr.Resource Permissions: From Artifactory 7.38.x, resource
               permissions scoped tokens are also supported in the REST API. A permission can be represented as a scope token string in
               the following format: `<resource-type>:<target>[/<sub-resource>]:<actions>` Where: `<resource-type>` - one of the
               permission resource types, from a predefined closed list. Currently, the only resource type that is supported is the
               artifact resource type. `<target>` - the target resource, can be exact name or a pattern `<sub-resource>` - optional,
               the target sub-resource, can be exact name or a pattern `<actions>` - comma-separated list of action acronyms.The
               actions allowed are `r`, `w`, `d`, `a`, `m`, `x`, `s`, or any combination of these actions. To allow all actions - use
               `*` Examples: `["applied-permissions/user", "artifact:generic-local:r"]` `["applied-permissions/group",
               "artifact:generic-local/path:*"]` `["applied-permissions/admin", "system:metrics:r", "artifact:generic-local:*"]` *
               `applied-permissions/roles:project-key` - provides access to elements associated with the project based on the project
               role. For example, `applied-permissions/roles:project-type:developer,qa`.The scope to assign to the token should be
               provided as a list of scope tokens, limited to 500 characters in total. From Artifactory 7.84.3, project admins
               (https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-token-creation-by-project-admins) can
               create access tokens that are tied to the projects in which they hold administrative privileges.
        :param pulumi.Input[str] username: The user name for which this token is created. The username is based on the authenticated user - either from the user of
               the authenticated token or based on the username (if basic auth was used). The username is then used to set the subject
               of the token: <service-id>/users/<username>. Limited to 255 characters.
        """
        if audiences is not None:
            pulumi.set(__self__, "audiences", audiences)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if expires_in is not None:
            pulumi.set(__self__, "expires_in", expires_in)
        if grant_type is not None:
            pulumi.set(__self__, "grant_type", grant_type)
        if include_reference_token is not None:
            pulumi.set(__self__, "include_reference_token", include_reference_token)
        if project_key is not None:
            pulumi.set(__self__, "project_key", project_key)
        if refreshable is not None:
            pulumi.set(__self__, "refreshable", refreshable)
        if scopes is not None:
            pulumi.set(__self__, "scopes", scopes)
        if username is not None:
            pulumi.set(__self__, "username", username)

    @property
    @pulumi.getter
    def audiences(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of the other instances or services that should accept this token identified by their Service-IDs. Limited to
        total 255 characters. Default to '*@*' if not set. Service ID must begin with valid JFrog service type. Options: jfrt,
        jfxr, jfpip, jfds, jfmc, jfac, jfevt, jfmd, jfcon, or *. For instructions to retrieve the Artifactory Service ID see
        this [documentation](https://jfrog.com/help/r/jfrog-rest-apis/get-service-id)
        """
        return pulumi.get(self, "audiences")

    @audiences.setter
    def audiences(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "audiences", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        Free text token description. Useful for filtering and managing tokens. Limited to 1024 characters.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter(name="expiresIn")
    def expires_in(self) -> Optional[pulumi.Input[int]]:
        """
        The amount of time, in seconds, it would take for the token to expire. An admin shall be able to set whether expiry is
        mandatory, what is the default expiry, and what is the maximum expiry allowed. Must be non-negative. Default value is
        based on configuration in 'access.config.yaml'. See [API
        documentation](https://jfrog.com/help/r/jfrog-rest-apis/revoke-token-by-id) for details. Access Token would not be saved
        by Artifactory if this is less than the persistence threshold value (default to 10800 seconds) set in Access
        configuration. See [official
        documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/persistency-threshold) for details.
        """
        return pulumi.get(self, "expires_in")

    @expires_in.setter
    def expires_in(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "expires_in", value)

    @property
    @pulumi.getter(name="grantType")
    def grant_type(self) -> Optional[pulumi.Input[str]]:
        """
        The grant type used to authenticate the request. In this case, the only value supported is `client_credentials` which is
        also the default value if this parameter is not specified.
        """
        return pulumi.get(self, "grant_type")

    @grant_type.setter
    def grant_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "grant_type", value)

    @property
    @pulumi.getter(name="includeReferenceToken")
    def include_reference_token(self) -> Optional[pulumi.Input[bool]]:
        """
        Also create a reference token which can be used like an API key. Default is `false`.
        """
        return pulumi.get(self, "include_reference_token")

    @include_reference_token.setter
    def include_reference_token(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "include_reference_token", value)

    @property
    @pulumi.getter(name="projectKey")
    def project_key(self) -> Optional[pulumi.Input[str]]:
        """
        The project for which this token is created. Enter the project name on which you want to apply this token.
        """
        return pulumi.get(self, "project_key")

    @project_key.setter
    def project_key(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "project_key", value)

    @property
    @pulumi.getter
    def refreshable(self) -> Optional[pulumi.Input[bool]]:
        """
        Is this token refreshable? Default is `false`.
        """
        return pulumi.get(self, "refreshable")

    @refreshable.setter
    def refreshable(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "refreshable", value)

    @property
    @pulumi.getter
    def scopes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The scope of access that the token provides. Access to the REST API is always provided by default. Administrators can
        set any scope, while non-admin users can only set the scope to a subset of the groups to which they belong. The
        supported scopes include: * `applied-permissions/user` - provides user access. If left at the default setting, the token
        will be created with the user-identity scope, which allows users to identify themselves in the Platform but does not
        grant any specific access permissions.* `applied-permissions/admin` - the scope assigned to admin users.*
        `applied-permissions/groups` - this scope assigns permissions to groups using the following format:
        applied-permissions/groups:<group-name>[,<group-name>...]* `system:metrics:r` - for getting the service metrics*
        `system:livelogs:r` - for getting the service livelogsr.Resource Permissions: From Artifactory 7.38.x, resource
        permissions scoped tokens are also supported in the REST API. A permission can be represented as a scope token string in
        the following format: `<resource-type>:<target>[/<sub-resource>]:<actions>` Where: `<resource-type>` - one of the
        permission resource types, from a predefined closed list. Currently, the only resource type that is supported is the
        artifact resource type. `<target>` - the target resource, can be exact name or a pattern `<sub-resource>` - optional,
        the target sub-resource, can be exact name or a pattern `<actions>` - comma-separated list of action acronyms.The
        actions allowed are `r`, `w`, `d`, `a`, `m`, `x`, `s`, or any combination of these actions. To allow all actions - use
        `*` Examples: `["applied-permissions/user", "artifact:generic-local:r"]` `["applied-permissions/group",
        "artifact:generic-local/path:*"]` `["applied-permissions/admin", "system:metrics:r", "artifact:generic-local:*"]` *
        `applied-permissions/roles:project-key` - provides access to elements associated with the project based on the project
        role. For example, `applied-permissions/roles:project-type:developer,qa`.The scope to assign to the token should be
        provided as a list of scope tokens, limited to 500 characters in total. From Artifactory 7.84.3, project admins
        (https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-token-creation-by-project-admins) can
        create access tokens that are tied to the projects in which they hold administrative privileges.
        """
        return pulumi.get(self, "scopes")

    @scopes.setter
    def scopes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "scopes", value)

    @property
    @pulumi.getter
    def username(self) -> Optional[pulumi.Input[str]]:
        """
        The user name for which this token is created. The username is based on the authenticated user - either from the user of
        the authenticated token or based on the username (if basic auth was used). The username is then used to set the subject
        of the token: <service-id>/users/<username>. Limited to 255 characters.
        """
        return pulumi.get(self, "username")

    @username.setter
    def username(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "username", value)


@pulumi.input_type
class _ScopedTokenState:
    def __init__(__self__, *,
                 access_token: Optional[pulumi.Input[str]] = None,
                 audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 description: Optional[pulumi.Input[str]] = None,
                 expires_in: Optional[pulumi.Input[int]] = None,
                 expiry: Optional[pulumi.Input[int]] = None,
                 grant_type: Optional[pulumi.Input[str]] = None,
                 include_reference_token: Optional[pulumi.Input[bool]] = None,
                 issued_at: Optional[pulumi.Input[int]] = None,
                 issuer: Optional[pulumi.Input[str]] = None,
                 project_key: Optional[pulumi.Input[str]] = None,
                 reference_token: Optional[pulumi.Input[str]] = None,
                 refresh_token: Optional[pulumi.Input[str]] = None,
                 refreshable: Optional[pulumi.Input[bool]] = None,
                 scopes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 subject: Optional[pulumi.Input[str]] = None,
                 token_type: Optional[pulumi.Input[str]] = None,
                 username: Optional[pulumi.Input[str]] = None):
        """
        Input properties used for looking up and filtering ScopedToken resources.
        :param pulumi.Input[str] access_token: Returns the access token to authenticate to Artifactory.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] audiences: A list of the other instances or services that should accept this token identified by their Service-IDs. Limited to
               total 255 characters. Default to '*@*' if not set. Service ID must begin with valid JFrog service type. Options: jfrt,
               jfxr, jfpip, jfds, jfmc, jfac, jfevt, jfmd, jfcon, or *. For instructions to retrieve the Artifactory Service ID see
               this [documentation](https://jfrog.com/help/r/jfrog-rest-apis/get-service-id)
        :param pulumi.Input[str] description: Free text token description. Useful for filtering and managing tokens. Limited to 1024 characters.
        :param pulumi.Input[int] expires_in: The amount of time, in seconds, it would take for the token to expire. An admin shall be able to set whether expiry is
               mandatory, what is the default expiry, and what is the maximum expiry allowed. Must be non-negative. Default value is
               based on configuration in 'access.config.yaml'. See [API
               documentation](https://jfrog.com/help/r/jfrog-rest-apis/revoke-token-by-id) for details. Access Token would not be saved
               by Artifactory if this is less than the persistence threshold value (default to 10800 seconds) set in Access
               configuration. See [official
               documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/persistency-threshold) for details.
        :param pulumi.Input[int] expiry: Returns the token expiry.
        :param pulumi.Input[str] grant_type: The grant type used to authenticate the request. In this case, the only value supported is `client_credentials` which is
               also the default value if this parameter is not specified.
        :param pulumi.Input[bool] include_reference_token: Also create a reference token which can be used like an API key. Default is `false`.
        :param pulumi.Input[int] issued_at: Returns the token issued at date/time.
        :param pulumi.Input[str] issuer: Returns the token issuer.
        :param pulumi.Input[str] project_key: The project for which this token is created. Enter the project name on which you want to apply this token.
        :param pulumi.Input[str] reference_token: Reference Token (alias to Access Token).
        :param pulumi.Input[str] refresh_token: Refresh token.
        :param pulumi.Input[bool] refreshable: Is this token refreshable? Default is `false`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] scopes: The scope of access that the token provides. Access to the REST API is always provided by default. Administrators can
               set any scope, while non-admin users can only set the scope to a subset of the groups to which they belong. The
               supported scopes include: * `applied-permissions/user` - provides user access. If left at the default setting, the token
               will be created with the user-identity scope, which allows users to identify themselves in the Platform but does not
               grant any specific access permissions.* `applied-permissions/admin` - the scope assigned to admin users.*
               `applied-permissions/groups` - this scope assigns permissions to groups using the following format:
               applied-permissions/groups:<group-name>[,<group-name>...]* `system:metrics:r` - for getting the service metrics*
               `system:livelogs:r` - for getting the service livelogsr.Resource Permissions: From Artifactory 7.38.x, resource
               permissions scoped tokens are also supported in the REST API. A permission can be represented as a scope token string in
               the following format: `<resource-type>:<target>[/<sub-resource>]:<actions>` Where: `<resource-type>` - one of the
               permission resource types, from a predefined closed list. Currently, the only resource type that is supported is the
               artifact resource type. `<target>` - the target resource, can be exact name or a pattern `<sub-resource>` - optional,
               the target sub-resource, can be exact name or a pattern `<actions>` - comma-separated list of action acronyms.The
               actions allowed are `r`, `w`, `d`, `a`, `m`, `x`, `s`, or any combination of these actions. To allow all actions - use
               `*` Examples: `["applied-permissions/user", "artifact:generic-local:r"]` `["applied-permissions/group",
               "artifact:generic-local/path:*"]` `["applied-permissions/admin", "system:metrics:r", "artifact:generic-local:*"]` *
               `applied-permissions/roles:project-key` - provides access to elements associated with the project based on the project
               role. For example, `applied-permissions/roles:project-type:developer,qa`.The scope to assign to the token should be
               provided as a list of scope tokens, limited to 500 characters in total. From Artifactory 7.84.3, project admins
               (https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-token-creation-by-project-admins) can
               create access tokens that are tied to the projects in which they hold administrative privileges.
        :param pulumi.Input[str] subject: Returns the token type.
        :param pulumi.Input[str] token_type: Returns the token type.
        :param pulumi.Input[str] username: The user name for which this token is created. The username is based on the authenticated user - either from the user of
               the authenticated token or based on the username (if basic auth was used). The username is then used to set the subject
               of the token: <service-id>/users/<username>. Limited to 255 characters.
        """
        if access_token is not None:
            pulumi.set(__self__, "access_token", access_token)
        if audiences is not None:
            pulumi.set(__self__, "audiences", audiences)
        if description is not None:
            pulumi.set(__self__, "description", description)
        if expires_in is not None:
            pulumi.set(__self__, "expires_in", expires_in)
        if expiry is not None:
            pulumi.set(__self__, "expiry", expiry)
        if grant_type is not None:
            pulumi.set(__self__, "grant_type", grant_type)
        if include_reference_token is not None:
            pulumi.set(__self__, "include_reference_token", include_reference_token)
        if issued_at is not None:
            pulumi.set(__self__, "issued_at", issued_at)
        if issuer is not None:
            pulumi.set(__self__, "issuer", issuer)
        if project_key is not None:
            pulumi.set(__self__, "project_key", project_key)
        if reference_token is not None:
            pulumi.set(__self__, "reference_token", reference_token)
        if refresh_token is not None:
            pulumi.set(__self__, "refresh_token", refresh_token)
        if refreshable is not None:
            pulumi.set(__self__, "refreshable", refreshable)
        if scopes is not None:
            pulumi.set(__self__, "scopes", scopes)
        if subject is not None:
            pulumi.set(__self__, "subject", subject)
        if token_type is not None:
            pulumi.set(__self__, "token_type", token_type)
        if username is not None:
            pulumi.set(__self__, "username", username)

    @property
    @pulumi.getter(name="accessToken")
    def access_token(self) -> Optional[pulumi.Input[str]]:
        """
        Returns the access token to authenticate to Artifactory.
        """
        return pulumi.get(self, "access_token")

    @access_token.setter
    def access_token(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "access_token", value)

    @property
    @pulumi.getter
    def audiences(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        A list of the other instances or services that should accept this token identified by their Service-IDs. Limited to
        total 255 characters. Default to '*@*' if not set. Service ID must begin with valid JFrog service type. Options: jfrt,
        jfxr, jfpip, jfds, jfmc, jfac, jfevt, jfmd, jfcon, or *. For instructions to retrieve the Artifactory Service ID see
        this [documentation](https://jfrog.com/help/r/jfrog-rest-apis/get-service-id)
        """
        return pulumi.get(self, "audiences")

    @audiences.setter
    def audiences(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "audiences", value)

    @property
    @pulumi.getter
    def description(self) -> Optional[pulumi.Input[str]]:
        """
        Free text token description. Useful for filtering and managing tokens. Limited to 1024 characters.
        """
        return pulumi.get(self, "description")

    @description.setter
    def description(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "description", value)

    @property
    @pulumi.getter(name="expiresIn")
    def expires_in(self) -> Optional[pulumi.Input[int]]:
        """
        The amount of time, in seconds, it would take for the token to expire. An admin shall be able to set whether expiry is
        mandatory, what is the default expiry, and what is the maximum expiry allowed. Must be non-negative. Default value is
        based on configuration in 'access.config.yaml'. See [API
        documentation](https://jfrog.com/help/r/jfrog-rest-apis/revoke-token-by-id) for details. Access Token would not be saved
        by Artifactory if this is less than the persistence threshold value (default to 10800 seconds) set in Access
        configuration. See [official
        documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/persistency-threshold) for details.
        """
        return pulumi.get(self, "expires_in")

    @expires_in.setter
    def expires_in(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "expires_in", value)

    @property
    @pulumi.getter
    def expiry(self) -> Optional[pulumi.Input[int]]:
        """
        Returns the token expiry.
        """
        return pulumi.get(self, "expiry")

    @expiry.setter
    def expiry(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "expiry", value)

    @property
    @pulumi.getter(name="grantType")
    def grant_type(self) -> Optional[pulumi.Input[str]]:
        """
        The grant type used to authenticate the request. In this case, the only value supported is `client_credentials` which is
        also the default value if this parameter is not specified.
        """
        return pulumi.get(self, "grant_type")

    @grant_type.setter
    def grant_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "grant_type", value)

    @property
    @pulumi.getter(name="includeReferenceToken")
    def include_reference_token(self) -> Optional[pulumi.Input[bool]]:
        """
        Also create a reference token which can be used like an API key. Default is `false`.
        """
        return pulumi.get(self, "include_reference_token")

    @include_reference_token.setter
    def include_reference_token(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "include_reference_token", value)

    @property
    @pulumi.getter(name="issuedAt")
    def issued_at(self) -> Optional[pulumi.Input[int]]:
        """
        Returns the token issued at date/time.
        """
        return pulumi.get(self, "issued_at")

    @issued_at.setter
    def issued_at(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "issued_at", value)

    @property
    @pulumi.getter
    def issuer(self) -> Optional[pulumi.Input[str]]:
        """
        Returns the token issuer.
        """
        return pulumi.get(self, "issuer")

    @issuer.setter
    def issuer(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "issuer", value)

    @property
    @pulumi.getter(name="projectKey")
    def project_key(self) -> Optional[pulumi.Input[str]]:
        """
        The project for which this token is created. Enter the project name on which you want to apply this token.
        """
        return pulumi.get(self, "project_key")

    @project_key.setter
    def project_key(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "project_key", value)

    @property
    @pulumi.getter(name="referenceToken")
    def reference_token(self) -> Optional[pulumi.Input[str]]:
        """
        Reference Token (alias to Access Token).
        """
        return pulumi.get(self, "reference_token")

    @reference_token.setter
    def reference_token(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "reference_token", value)

    @property
    @pulumi.getter(name="refreshToken")
    def refresh_token(self) -> Optional[pulumi.Input[str]]:
        """
        Refresh token.
        """
        return pulumi.get(self, "refresh_token")

    @refresh_token.setter
    def refresh_token(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "refresh_token", value)

    @property
    @pulumi.getter
    def refreshable(self) -> Optional[pulumi.Input[bool]]:
        """
        Is this token refreshable? Default is `false`.
        """
        return pulumi.get(self, "refreshable")

    @refreshable.setter
    def refreshable(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "refreshable", value)

    @property
    @pulumi.getter
    def scopes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        The scope of access that the token provides. Access to the REST API is always provided by default. Administrators can
        set any scope, while non-admin users can only set the scope to a subset of the groups to which they belong. The
        supported scopes include: * `applied-permissions/user` - provides user access. If left at the default setting, the token
        will be created with the user-identity scope, which allows users to identify themselves in the Platform but does not
        grant any specific access permissions.* `applied-permissions/admin` - the scope assigned to admin users.*
        `applied-permissions/groups` - this scope assigns permissions to groups using the following format:
        applied-permissions/groups:<group-name>[,<group-name>...]* `system:metrics:r` - for getting the service metrics*
        `system:livelogs:r` - for getting the service livelogsr.Resource Permissions: From Artifactory 7.38.x, resource
        permissions scoped tokens are also supported in the REST API. A permission can be represented as a scope token string in
        the following format: `<resource-type>:<target>[/<sub-resource>]:<actions>` Where: `<resource-type>` - one of the
        permission resource types, from a predefined closed list. Currently, the only resource type that is supported is the
        artifact resource type. `<target>` - the target resource, can be exact name or a pattern `<sub-resource>` - optional,
        the target sub-resource, can be exact name or a pattern `<actions>` - comma-separated list of action acronyms.The
        actions allowed are `r`, `w`, `d`, `a`, `m`, `x`, `s`, or any combination of these actions. To allow all actions - use
        `*` Examples: `["applied-permissions/user", "artifact:generic-local:r"]` `["applied-permissions/group",
        "artifact:generic-local/path:*"]` `["applied-permissions/admin", "system:metrics:r", "artifact:generic-local:*"]` *
        `applied-permissions/roles:project-key` - provides access to elements associated with the project based on the project
        role. For example, `applied-permissions/roles:project-type:developer,qa`.The scope to assign to the token should be
        provided as a list of scope tokens, limited to 500 characters in total. From Artifactory 7.84.3, project admins
        (https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-token-creation-by-project-admins) can
        create access tokens that are tied to the projects in which they hold administrative privileges.
        """
        return pulumi.get(self, "scopes")

    @scopes.setter
    def scopes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "scopes", value)

    @property
    @pulumi.getter
    def subject(self) -> Optional[pulumi.Input[str]]:
        """
        Returns the token type.
        """
        return pulumi.get(self, "subject")

    @subject.setter
    def subject(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "subject", value)

    @property
    @pulumi.getter(name="tokenType")
    def token_type(self) -> Optional[pulumi.Input[str]]:
        """
        Returns the token type.
        """
        return pulumi.get(self, "token_type")

    @token_type.setter
    def token_type(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "token_type", value)

    @property
    @pulumi.getter
    def username(self) -> Optional[pulumi.Input[str]]:
        """
        The user name for which this token is created. The username is based on the authenticated user - either from the user of
        the authenticated token or based on the username (if basic auth was used). The username is then used to set the subject
        of the token: <service-id>/users/<username>. Limited to 255 characters.
        """
        return pulumi.get(self, "username")

    @username.setter
    def username(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "username", value)


class ScopedToken(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 description: Optional[pulumi.Input[str]] = None,
                 expires_in: Optional[pulumi.Input[int]] = None,
                 grant_type: Optional[pulumi.Input[str]] = None,
                 include_reference_token: Optional[pulumi.Input[bool]] = None,
                 project_key: Optional[pulumi.Input[str]] = None,
                 refreshable: Optional[pulumi.Input[bool]] = None,
                 scopes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 username: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        """
        Provides an Artifactory Scoped Token resource. This can be used to create and manage Artifactory Scoped Tokens.

        !>Scoped Tokens will be stored in the raw state as plain-text. Read more about sensitive data in
        state.

        ~>Token would not be saved by Artifactory if `expires_in` is less than the persistency threshold value (default to 10800 seconds) set in Access configuration. See [Persistency Threshold](https://jfrog.com/help/r/jfrog-platform-administration-documentation/persistency-threshold) for details.

        ## Example Usage

        ### S

        ```python
        import pulumi
        import pulumi_artifactory as artifactory

        ### Create a new Artifactory scoped token for an existing user
        scoped_token = artifactory.ScopedToken("scoped_token", username="existing-user")
        ### **Note:** This assumes that the user `existing-user` has already been created in Artifactory by different means, i.e. manually or in a separate pulumi up.
        ### Create a new Artifactory user and scoped token
        new_user = artifactory.User("new_user",
            name="new_user",
            email="new_user@somewhere.com",
            groups=["readers"])
        scoped_token_user = artifactory.ScopedToken("scoped_token_user", username=new_user.name)
        ### Creates a new token for groups
        scoped_token_group = artifactory.ScopedToken("scoped_token_group", scopes=["applied-permissions/groups:readers"])
        ### Create token with expiry
        scoped_token_no_expiry = artifactory.ScopedToken("scoped_token_no_expiry",
            username="existing-user",
            expires_in=7200)
        ### Creates a refreshable token
        scoped_token_refreshable = artifactory.ScopedToken("scoped_token_refreshable",
            username="existing-user",
            refreshable=True)
        ### Creates an administrator token
        admin = artifactory.ScopedToken("admin",
            username="admin-user",
            scopes=["applied-permissions/admin"])
        ### Creates a token with an audience
        audience = artifactory.ScopedToken("audience",
            username="admin-user",
            scopes=["applied-permissions/admin"],
            audiences=["jfrt@*"])
        ```

        ## References

        - https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-tokens
        - https://jfrog.com/help/r/jfrog-rest-apis/access-tokens

        ## Import

        Artifactory **does not** retain scoped tokens, and they cannot be imported into state.

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] audiences: A list of the other instances or services that should accept this token identified by their Service-IDs. Limited to
               total 255 characters. Default to '*@*' if not set. Service ID must begin with valid JFrog service type. Options: jfrt,
               jfxr, jfpip, jfds, jfmc, jfac, jfevt, jfmd, jfcon, or *. For instructions to retrieve the Artifactory Service ID see
               this [documentation](https://jfrog.com/help/r/jfrog-rest-apis/get-service-id)
        :param pulumi.Input[str] description: Free text token description. Useful for filtering and managing tokens. Limited to 1024 characters.
        :param pulumi.Input[int] expires_in: The amount of time, in seconds, it would take for the token to expire. An admin shall be able to set whether expiry is
               mandatory, what is the default expiry, and what is the maximum expiry allowed. Must be non-negative. Default value is
               based on configuration in 'access.config.yaml'. See [API
               documentation](https://jfrog.com/help/r/jfrog-rest-apis/revoke-token-by-id) for details. Access Token would not be saved
               by Artifactory if this is less than the persistence threshold value (default to 10800 seconds) set in Access
               configuration. See [official
               documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/persistency-threshold) for details.
        :param pulumi.Input[str] grant_type: The grant type used to authenticate the request. In this case, the only value supported is `client_credentials` which is
               also the default value if this parameter is not specified.
        :param pulumi.Input[bool] include_reference_token: Also create a reference token which can be used like an API key. Default is `false`.
        :param pulumi.Input[str] project_key: The project for which this token is created. Enter the project name on which you want to apply this token.
        :param pulumi.Input[bool] refreshable: Is this token refreshable? Default is `false`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] scopes: The scope of access that the token provides. Access to the REST API is always provided by default. Administrators can
               set any scope, while non-admin users can only set the scope to a subset of the groups to which they belong. The
               supported scopes include: * `applied-permissions/user` - provides user access. If left at the default setting, the token
               will be created with the user-identity scope, which allows users to identify themselves in the Platform but does not
               grant any specific access permissions.* `applied-permissions/admin` - the scope assigned to admin users.*
               `applied-permissions/groups` - this scope assigns permissions to groups using the following format:
               applied-permissions/groups:<group-name>[,<group-name>...]* `system:metrics:r` - for getting the service metrics*
               `system:livelogs:r` - for getting the service livelogsr.Resource Permissions: From Artifactory 7.38.x, resource
               permissions scoped tokens are also supported in the REST API. A permission can be represented as a scope token string in
               the following format: `<resource-type>:<target>[/<sub-resource>]:<actions>` Where: `<resource-type>` - one of the
               permission resource types, from a predefined closed list. Currently, the only resource type that is supported is the
               artifact resource type. `<target>` - the target resource, can be exact name or a pattern `<sub-resource>` - optional,
               the target sub-resource, can be exact name or a pattern `<actions>` - comma-separated list of action acronyms.The
               actions allowed are `r`, `w`, `d`, `a`, `m`, `x`, `s`, or any combination of these actions. To allow all actions - use
               `*` Examples: `["applied-permissions/user", "artifact:generic-local:r"]` `["applied-permissions/group",
               "artifact:generic-local/path:*"]` `["applied-permissions/admin", "system:metrics:r", "artifact:generic-local:*"]` *
               `applied-permissions/roles:project-key` - provides access to elements associated with the project based on the project
               role. For example, `applied-permissions/roles:project-type:developer,qa`.The scope to assign to the token should be
               provided as a list of scope tokens, limited to 500 characters in total. From Artifactory 7.84.3, project admins
               (https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-token-creation-by-project-admins) can
               create access tokens that are tied to the projects in which they hold administrative privileges.
        :param pulumi.Input[str] username: The user name for which this token is created. The username is based on the authenticated user - either from the user of
               the authenticated token or based on the username (if basic auth was used). The username is then used to set the subject
               of the token: <service-id>/users/<username>. Limited to 255 characters.
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: Optional[ScopedTokenArgs] = None,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        Provides an Artifactory Scoped Token resource. This can be used to create and manage Artifactory Scoped Tokens.

        !>Scoped Tokens will be stored in the raw state as plain-text. Read more about sensitive data in
        state.

        ~>Token would not be saved by Artifactory if `expires_in` is less than the persistency threshold value (default to 10800 seconds) set in Access configuration. See [Persistency Threshold](https://jfrog.com/help/r/jfrog-platform-administration-documentation/persistency-threshold) for details.

        ## Example Usage

        ### S

        ```python
        import pulumi
        import pulumi_artifactory as artifactory

        ### Create a new Artifactory scoped token for an existing user
        scoped_token = artifactory.ScopedToken("scoped_token", username="existing-user")
        ### **Note:** This assumes that the user `existing-user` has already been created in Artifactory by different means, i.e. manually or in a separate pulumi up.
        ### Create a new Artifactory user and scoped token
        new_user = artifactory.User("new_user",
            name="new_user",
            email="new_user@somewhere.com",
            groups=["readers"])
        scoped_token_user = artifactory.ScopedToken("scoped_token_user", username=new_user.name)
        ### Creates a new token for groups
        scoped_token_group = artifactory.ScopedToken("scoped_token_group", scopes=["applied-permissions/groups:readers"])
        ### Create token with expiry
        scoped_token_no_expiry = artifactory.ScopedToken("scoped_token_no_expiry",
            username="existing-user",
            expires_in=7200)
        ### Creates a refreshable token
        scoped_token_refreshable = artifactory.ScopedToken("scoped_token_refreshable",
            username="existing-user",
            refreshable=True)
        ### Creates an administrator token
        admin = artifactory.ScopedToken("admin",
            username="admin-user",
            scopes=["applied-permissions/admin"])
        ### Creates a token with an audience
        audience = artifactory.ScopedToken("audience",
            username="admin-user",
            scopes=["applied-permissions/admin"],
            audiences=["jfrt@*"])
        ```

        ## References

        - https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-tokens
        - https://jfrog.com/help/r/jfrog-rest-apis/access-tokens

        ## Import

        Artifactory **does not** retain scoped tokens, and they cannot be imported into state.

        :param str resource_name: The name of the resource.
        :param ScopedTokenArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(ScopedTokenArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 description: Optional[pulumi.Input[str]] = None,
                 expires_in: Optional[pulumi.Input[int]] = None,
                 grant_type: Optional[pulumi.Input[str]] = None,
                 include_reference_token: Optional[pulumi.Input[bool]] = None,
                 project_key: Optional[pulumi.Input[str]] = None,
                 refreshable: Optional[pulumi.Input[bool]] = None,
                 scopes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 username: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = ScopedTokenArgs.__new__(ScopedTokenArgs)

            __props__.__dict__["audiences"] = audiences
            __props__.__dict__["description"] = description
            __props__.__dict__["expires_in"] = expires_in
            __props__.__dict__["grant_type"] = grant_type
            __props__.__dict__["include_reference_token"] = include_reference_token
            __props__.__dict__["project_key"] = project_key
            __props__.__dict__["refreshable"] = refreshable
            __props__.__dict__["scopes"] = scopes
            __props__.__dict__["username"] = username
            __props__.__dict__["access_token"] = None
            __props__.__dict__["expiry"] = None
            __props__.__dict__["issued_at"] = None
            __props__.__dict__["issuer"] = None
            __props__.__dict__["reference_token"] = None
            __props__.__dict__["refresh_token"] = None
            __props__.__dict__["subject"] = None
            __props__.__dict__["token_type"] = None
        secret_opts = pulumi.ResourceOptions(additional_secret_outputs=["accessToken", "referenceToken", "refreshToken"])
        opts = pulumi.ResourceOptions.merge(opts, secret_opts)
        super(ScopedToken, __self__).__init__(
            'artifactory:index/scopedToken:ScopedToken',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            access_token: Optional[pulumi.Input[str]] = None,
            audiences: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            description: Optional[pulumi.Input[str]] = None,
            expires_in: Optional[pulumi.Input[int]] = None,
            expiry: Optional[pulumi.Input[int]] = None,
            grant_type: Optional[pulumi.Input[str]] = None,
            include_reference_token: Optional[pulumi.Input[bool]] = None,
            issued_at: Optional[pulumi.Input[int]] = None,
            issuer: Optional[pulumi.Input[str]] = None,
            project_key: Optional[pulumi.Input[str]] = None,
            reference_token: Optional[pulumi.Input[str]] = None,
            refresh_token: Optional[pulumi.Input[str]] = None,
            refreshable: Optional[pulumi.Input[bool]] = None,
            scopes: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
            subject: Optional[pulumi.Input[str]] = None,
            token_type: Optional[pulumi.Input[str]] = None,
            username: Optional[pulumi.Input[str]] = None) -> 'ScopedToken':
        """
        Get an existing ScopedToken resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[str] access_token: Returns the access token to authenticate to Artifactory.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] audiences: A list of the other instances or services that should accept this token identified by their Service-IDs. Limited to
               total 255 characters. Default to '*@*' if not set. Service ID must begin with valid JFrog service type. Options: jfrt,
               jfxr, jfpip, jfds, jfmc, jfac, jfevt, jfmd, jfcon, or *. For instructions to retrieve the Artifactory Service ID see
               this [documentation](https://jfrog.com/help/r/jfrog-rest-apis/get-service-id)
        :param pulumi.Input[str] description: Free text token description. Useful for filtering and managing tokens. Limited to 1024 characters.
        :param pulumi.Input[int] expires_in: The amount of time, in seconds, it would take for the token to expire. An admin shall be able to set whether expiry is
               mandatory, what is the default expiry, and what is the maximum expiry allowed. Must be non-negative. Default value is
               based on configuration in 'access.config.yaml'. See [API
               documentation](https://jfrog.com/help/r/jfrog-rest-apis/revoke-token-by-id) for details. Access Token would not be saved
               by Artifactory if this is less than the persistence threshold value (default to 10800 seconds) set in Access
               configuration. See [official
               documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/persistency-threshold) for details.
        :param pulumi.Input[int] expiry: Returns the token expiry.
        :param pulumi.Input[str] grant_type: The grant type used to authenticate the request. In this case, the only value supported is `client_credentials` which is
               also the default value if this parameter is not specified.
        :param pulumi.Input[bool] include_reference_token: Also create a reference token which can be used like an API key. Default is `false`.
        :param pulumi.Input[int] issued_at: Returns the token issued at date/time.
        :param pulumi.Input[str] issuer: Returns the token issuer.
        :param pulumi.Input[str] project_key: The project for which this token is created. Enter the project name on which you want to apply this token.
        :param pulumi.Input[str] reference_token: Reference Token (alias to Access Token).
        :param pulumi.Input[str] refresh_token: Refresh token.
        :param pulumi.Input[bool] refreshable: Is this token refreshable? Default is `false`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] scopes: The scope of access that the token provides. Access to the REST API is always provided by default. Administrators can
               set any scope, while non-admin users can only set the scope to a subset of the groups to which they belong. The
               supported scopes include: * `applied-permissions/user` - provides user access. If left at the default setting, the token
               will be created with the user-identity scope, which allows users to identify themselves in the Platform but does not
               grant any specific access permissions.* `applied-permissions/admin` - the scope assigned to admin users.*
               `applied-permissions/groups` - this scope assigns permissions to groups using the following format:
               applied-permissions/groups:<group-name>[,<group-name>...]* `system:metrics:r` - for getting the service metrics*
               `system:livelogs:r` - for getting the service livelogsr.Resource Permissions: From Artifactory 7.38.x, resource
               permissions scoped tokens are also supported in the REST API. A permission can be represented as a scope token string in
               the following format: `<resource-type>:<target>[/<sub-resource>]:<actions>` Where: `<resource-type>` - one of the
               permission resource types, from a predefined closed list. Currently, the only resource type that is supported is the
               artifact resource type. `<target>` - the target resource, can be exact name or a pattern `<sub-resource>` - optional,
               the target sub-resource, can be exact name or a pattern `<actions>` - comma-separated list of action acronyms.The
               actions allowed are `r`, `w`, `d`, `a`, `m`, `x`, `s`, or any combination of these actions. To allow all actions - use
               `*` Examples: `["applied-permissions/user", "artifact:generic-local:r"]` `["applied-permissions/group",
               "artifact:generic-local/path:*"]` `["applied-permissions/admin", "system:metrics:r", "artifact:generic-local:*"]` *
               `applied-permissions/roles:project-key` - provides access to elements associated with the project based on the project
               role. For example, `applied-permissions/roles:project-type:developer,qa`.The scope to assign to the token should be
               provided as a list of scope tokens, limited to 500 characters in total. From Artifactory 7.84.3, project admins
               (https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-token-creation-by-project-admins) can
               create access tokens that are tied to the projects in which they hold administrative privileges.
        :param pulumi.Input[str] subject: Returns the token type.
        :param pulumi.Input[str] token_type: Returns the token type.
        :param pulumi.Input[str] username: The user name for which this token is created. The username is based on the authenticated user - either from the user of
               the authenticated token or based on the username (if basic auth was used). The username is then used to set the subject
               of the token: <service-id>/users/<username>. Limited to 255 characters.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _ScopedTokenState.__new__(_ScopedTokenState)

        __props__.__dict__["access_token"] = access_token
        __props__.__dict__["audiences"] = audiences
        __props__.__dict__["description"] = description
        __props__.__dict__["expires_in"] = expires_in
        __props__.__dict__["expiry"] = expiry
        __props__.__dict__["grant_type"] = grant_type
        __props__.__dict__["include_reference_token"] = include_reference_token
        __props__.__dict__["issued_at"] = issued_at
        __props__.__dict__["issuer"] = issuer
        __props__.__dict__["project_key"] = project_key
        __props__.__dict__["reference_token"] = reference_token
        __props__.__dict__["refresh_token"] = refresh_token
        __props__.__dict__["refreshable"] = refreshable
        __props__.__dict__["scopes"] = scopes
        __props__.__dict__["subject"] = subject
        __props__.__dict__["token_type"] = token_type
        __props__.__dict__["username"] = username
        return ScopedToken(resource_name, opts=opts, __props__=__props__)

    @property
    @pulumi.getter(name="accessToken")
    def access_token(self) -> pulumi.Output[str]:
        """
        Returns the access token to authenticate to Artifactory.
        """
        return pulumi.get(self, "access_token")

    @property
    @pulumi.getter
    def audiences(self) -> pulumi.Output[Optional[Sequence[str]]]:
        """
        A list of the other instances or services that should accept this token identified by their Service-IDs. Limited to
        total 255 characters. Default to '*@*' if not set. Service ID must begin with valid JFrog service type. Options: jfrt,
        jfxr, jfpip, jfds, jfmc, jfac, jfevt, jfmd, jfcon, or *. For instructions to retrieve the Artifactory Service ID see
        this [documentation](https://jfrog.com/help/r/jfrog-rest-apis/get-service-id)
        """
        return pulumi.get(self, "audiences")

    @property
    @pulumi.getter
    def description(self) -> pulumi.Output[str]:
        """
        Free text token description. Useful for filtering and managing tokens. Limited to 1024 characters.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter(name="expiresIn")
    def expires_in(self) -> pulumi.Output[int]:
        """
        The amount of time, in seconds, it would take for the token to expire. An admin shall be able to set whether expiry is
        mandatory, what is the default expiry, and what is the maximum expiry allowed. Must be non-negative. Default value is
        based on configuration in 'access.config.yaml'. See [API
        documentation](https://jfrog.com/help/r/jfrog-rest-apis/revoke-token-by-id) for details. Access Token would not be saved
        by Artifactory if this is less than the persistence threshold value (default to 10800 seconds) set in Access
        configuration. See [official
        documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/persistency-threshold) for details.
        """
        return pulumi.get(self, "expires_in")

    @property
    @pulumi.getter
    def expiry(self) -> pulumi.Output[int]:
        """
        Returns the token expiry.
        """
        return pulumi.get(self, "expiry")

    @property
    @pulumi.getter(name="grantType")
    def grant_type(self) -> pulumi.Output[str]:
        """
        The grant type used to authenticate the request. In this case, the only value supported is `client_credentials` which is
        also the default value if this parameter is not specified.
        """
        return pulumi.get(self, "grant_type")

    @property
    @pulumi.getter(name="includeReferenceToken")
    def include_reference_token(self) -> pulumi.Output[bool]:
        """
        Also create a reference token which can be used like an API key. Default is `false`.
        """
        return pulumi.get(self, "include_reference_token")

    @property
    @pulumi.getter(name="issuedAt")
    def issued_at(self) -> pulumi.Output[int]:
        """
        Returns the token issued at date/time.
        """
        return pulumi.get(self, "issued_at")

    @property
    @pulumi.getter
    def issuer(self) -> pulumi.Output[str]:
        """
        Returns the token issuer.
        """
        return pulumi.get(self, "issuer")

    @property
    @pulumi.getter(name="projectKey")
    def project_key(self) -> pulumi.Output[Optional[str]]:
        """
        The project for which this token is created. Enter the project name on which you want to apply this token.
        """
        return pulumi.get(self, "project_key")

    @property
    @pulumi.getter(name="referenceToken")
    def reference_token(self) -> pulumi.Output[str]:
        """
        Reference Token (alias to Access Token).
        """
        return pulumi.get(self, "reference_token")

    @property
    @pulumi.getter(name="refreshToken")
    def refresh_token(self) -> pulumi.Output[str]:
        """
        Refresh token.
        """
        return pulumi.get(self, "refresh_token")

    @property
    @pulumi.getter
    def refreshable(self) -> pulumi.Output[bool]:
        """
        Is this token refreshable? Default is `false`.
        """
        return pulumi.get(self, "refreshable")

    @property
    @pulumi.getter
    def scopes(self) -> pulumi.Output[Sequence[str]]:
        """
        The scope of access that the token provides. Access to the REST API is always provided by default. Administrators can
        set any scope, while non-admin users can only set the scope to a subset of the groups to which they belong. The
        supported scopes include: * `applied-permissions/user` - provides user access. If left at the default setting, the token
        will be created with the user-identity scope, which allows users to identify themselves in the Platform but does not
        grant any specific access permissions.* `applied-permissions/admin` - the scope assigned to admin users.*
        `applied-permissions/groups` - this scope assigns permissions to groups using the following format:
        applied-permissions/groups:<group-name>[,<group-name>...]* `system:metrics:r` - for getting the service metrics*
        `system:livelogs:r` - for getting the service livelogsr.Resource Permissions: From Artifactory 7.38.x, resource
        permissions scoped tokens are also supported in the REST API. A permission can be represented as a scope token string in
        the following format: `<resource-type>:<target>[/<sub-resource>]:<actions>` Where: `<resource-type>` - one of the
        permission resource types, from a predefined closed list. Currently, the only resource type that is supported is the
        artifact resource type. `<target>` - the target resource, can be exact name or a pattern `<sub-resource>` - optional,
        the target sub-resource, can be exact name or a pattern `<actions>` - comma-separated list of action acronyms.The
        actions allowed are `r`, `w`, `d`, `a`, `m`, `x`, `s`, or any combination of these actions. To allow all actions - use
        `*` Examples: `["applied-permissions/user", "artifact:generic-local:r"]` `["applied-permissions/group",
        "artifact:generic-local/path:*"]` `["applied-permissions/admin", "system:metrics:r", "artifact:generic-local:*"]` *
        `applied-permissions/roles:project-key` - provides access to elements associated with the project based on the project
        role. For example, `applied-permissions/roles:project-type:developer,qa`.The scope to assign to the token should be
        provided as a list of scope tokens, limited to 500 characters in total. From Artifactory 7.84.3, project admins
        (https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-token-creation-by-project-admins) can
        create access tokens that are tied to the projects in which they hold administrative privileges.
        """
        return pulumi.get(self, "scopes")

    @property
    @pulumi.getter
    def subject(self) -> pulumi.Output[str]:
        """
        Returns the token type.
        """
        return pulumi.get(self, "subject")

    @property
    @pulumi.getter(name="tokenType")
    def token_type(self) -> pulumi.Output[str]:
        """
        Returns the token type.
        """
        return pulumi.get(self, "token_type")

    @property
    @pulumi.getter
    def username(self) -> pulumi.Output[Optional[str]]:
        """
        The user name for which this token is created. The username is based on the authenticated user - either from the user of
        the authenticated token or based on the username (if basic auth was used). The username is then used to set the subject
        of the token: <service-id>/users/<username>. Limited to 255 characters.
        """
        return pulumi.get(self, "username")

