---
page_title: "ona_integration Resource - ona"
subcategory: "Integrations and Automation"
description: |-
  Ona organization integration. Use a definition ID from ona_integration_definitions for a built-in integration, whose authentication is managed by Ona, or omit it to configure a custom MCP integration. Integration writes require organization integration permissions. Removing this resource deletes the remote integration.
---

# ona_integration (Resource)

Ona organization integration. Use a definition ID from `ona_integration_definitions` for a built-in integration, whose authentication is managed by Ona, or omit it to configure a custom MCP integration. Integration writes require organization integration permissions. Removing this resource deletes the remote integration.

For product context, see [Integrations](https://ona.com/docs/ona/integrations/overview), [MCP servers](https://ona.com/docs/ona/mcp), and [Git providers](https://ona.com/docs/ona/source-control/overview).

## Example Usage

```terraform
data "ona_integration_definitions" "available" {}

locals {
  linear_definition = one([
    for definition in data.ona_integration_definitions.available.definitions : definition
    if definition.host == "linear.app"
  ])
}

resource "ona_integration" "linear" {
  integration_definition_id = local.linear_definition.id
  enabled                   = true
}

variable "custom_mcp_client_secret" {
  type        = string
  sensitive   = true
  nullable    = false
  description = "OAuth client secret for the custom MCP integration."
}

resource "ona_integration" "custom_mcp" {
  name        = "Example MCP server"
  description = "Custom MCP integration managed with Terraform."
  enabled     = true

  capabilities = {
    mcp = {
      url = "https://mcp.example.com/mcp"
    }
  }

  auth = {
    oauth = {
      client_id             = "example-client-id"
      client_secret_version = "v1"
    }
  }

  credentials = {
    oauth_client_secret = var.custom_mcp_client_secret
  }
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Optional

> **NOTE**: [Write-only arguments](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments) are supported in Terraform 1.11 and later.

- `auth` (Attributes) Authentication configuration for a custom integration. Do not configure this block when `integration_definition_id` is set; definition-backed authentication is managed by Ona. Authentication is immutable after a custom integration is created. (see [below for nested schema](#nestedatt--auth))
- `capabilities` (Attributes) Effective integration capabilities. Omitted values may be inherited from the selected definition. Capabilities are immutable for custom integrations. (see [below for nested schema](#nestedatt--capabilities))
- `categories` (Set of String) Integration categories. Supported values are `source_control`, `communication`, `project_management`, `observability`, `data_analytics`, `knowledge`, `mcp`, `automation_triggers`, and `ai`. Definition-backed integrations inherit categories when omitted. Clearing custom categories replaces the integration; clearing definition-backed categories is not representable and returns a plan diagnostic.
- `credentials` (Attributes, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Write-only credentials for a custom integration. Do not configure this block when `integration_definition_id` is set. Values are sent to Ona but are never stored in Terraform plan or state. Pair each value with its version marker under `auth` to rotate it intentionally. (see [below for nested schema](#nestedatt--credentials))
- `description` (String) Custom integration description. Definition-backed integrations inherit their description. Changing it replaces the integration.
- `enabled` (Boolean) Whether the integration is enabled. Defaults to `false`.
- `host` (String) Integration host. Definition-backed integrations inherit it when omitted; custom integrations derive it from the MCP URL when omitted. Changing it replaces the integration.
- `integration_definition_id` (String) Global integration definition ID. Omit this value for a custom MCP integration. Definition-backed integrations cannot configure `auth` or `credentials`. Changing it replaces the integration.
- `name` (String) Integration display name. Required for custom integrations and inherited for definition-backed integrations. Changing it replaces the integration.
- `runner_id` (String) Runner ID to which this integration is restricted. Changing it replaces the integration.

### Read-Only

- `external_installation` (Attributes) Provider-side app installation associated with this integration, when known. (see [below for nested schema](#nestedatt--external_installation))
- `icon_url` (String) Integration icon URL resolved from the selected definition, when present.
- `id` (String) Integration ID. Use this value as the Terraform import ID.
- `organization_id` (String) Organization ID that owns the integration.

<a id="nestedatt--auth"></a>
### Nested Schema for `auth`

Optional:

- `api_key` (Attributes) API-key authentication support marker. This block does not contain the key value. (see [below for nested schema](#nestedatt--auth--api_key))
- `oauth` (Attributes) OAuth configuration. (see [below for nested schema](#nestedatt--auth--oauth))
- `proprietary_app` (Attributes) Provider-specific application configuration. (see [below for nested schema](#nestedatt--auth--proprietary_app))
- `requires_auth` (Boolean) Whether the integration requires authentication. Definition-backed integrations inherit this value and cannot override it.

<a id="nestedatt--auth--api_key"></a>
### Nested Schema for `auth.api_key`


<a id="nestedatt--auth--oauth"></a>
### Nested Schema for `auth.oauth`

Optional:

- `auth_params` (Map of String) Additional OAuth authorization query parameters.
- `auth_url` (String) OAuth authorization endpoint URL.
- `client_id` (String) OAuth client ID.
- `client_secret_version` (String) User-managed marker for resubmitting or rotating `client_secret`.
- `dynamic_registration` (Boolean) Whether RFC 7591 dynamic client registration is enabled.
- `redirect_url` (String) OAuth redirect URL.
- `scopes` (Set of String) OAuth scopes.
- `token_url` (String) OAuth token endpoint URL.


<a id="nestedatt--auth--proprietary_app"></a>
### Nested Schema for `auth.proprietary_app`

Optional:

- `api_key_version` (String) User-managed marker for resubmitting or rotating `api_key`.
- `app_id` (String) Provider-assigned application ID.
- `app_scopes` (Set of String) Provider application OAuth scopes.
- `app_slug` (String) Provider-assigned application slug.
- `auth_params` (Map of String) Additional provider authorization parameters.
- `client_id` (String) Provider application client ID.
- `client_secret_version` (String) User-managed marker for resubmitting or rotating `client_secret`.
- `private_key_version` (String) User-managed marker for resubmitting or rotating `private_key`.
- `token_url` (String) Provider application token endpoint URL.
- `webhook_secret_version` (String) User-managed marker for resubmitting or rotating `webhook_secret`.



<a id="nestedatt--capabilities"></a>
### Nested Schema for `capabilities`

Optional:

- `agent_client` (Attributes) Agent-client capability. (see [below for nested schema](#nestedatt--capabilities--agent_client))
- `context_parsing` (Attributes) Context parsing capability. (see [below for nested schema](#nestedatt--capabilities--context_parsing))
- `login` (Attributes) Login capability. (see [below for nested schema](#nestedatt--capabilities--login))
- `mcp` (Attributes) Model Context Protocol capability. (see [below for nested schema](#nestedatt--capabilities--mcp))
- `scm_pr_events` (Attributes) SCM pull-request event capability. (see [below for nested schema](#nestedatt--capabilities--scm_pr_events))
- `source_code_access` (Attributes) Source code access capability. (see [below for nested schema](#nestedatt--capabilities--source_code_access))

<a id="nestedatt--capabilities--agent_client"></a>
### Nested Schema for `capabilities.agent_client`

Optional:

- `default_project_id` (String) Default Ona project ID when no project can be resolved from event context.
- `severity_threshold` (String) Minimum incident severity that triggers an agent session. Supported values are `SEV1`, `SEV2`, and `SEV3`.


<a id="nestedatt--capabilities--context_parsing"></a>
### Nested Schema for `capabilities.context_parsing`


<a id="nestedatt--capabilities--login"></a>
### Nested Schema for `capabilities.login`


<a id="nestedatt--capabilities--mcp"></a>
### Nested Schema for `capabilities.mcp`

Optional:

- `url` (String) Remote MCP server URL. Custom integrations require a public HTTPS URL.


<a id="nestedatt--capabilities--scm_pr_events"></a>
### Nested Schema for `capabilities.scm_pr_events`


<a id="nestedatt--capabilities--source_code_access"></a>
### Nested Schema for `capabilities.source_code_access`



<a id="nestedatt--credentials"></a>
### Nested Schema for `credentials`

Optional:

- `oauth_client_secret` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) OAuth client secret.
- `proprietary_api_key` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Provider API key used for outbound updates.
- `proprietary_client_secret` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Provider application client secret.
- `proprietary_private_key` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) PEM-encoded private key for application authentication.
- `proprietary_webhook_secret` (String, Sensitive, [Write-only](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments)) Secret used to verify provider webhook signatures.


<a id="nestedatt--external_installation"></a>
### Nested Schema for `external_installation`

Read-Only:

- `account_name` (String) Provider account or organization name.
- `account_type` (String) Provider account type.
- `id` (String) Provider-assigned installation ID.

## Import

Import is supported using the following syntax:

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
#!/usr/bin/env sh

terraform import ona_integration.linear 00000000-0000-0000-0000-000000000000
```