For EU region, you need to use the region-specific endpoint

<http://api.eu.permit.io|api.eu.permit.io>

instead of the default

<http://api.permit.io|api.permit.io>

. (1) The CLI commands don't have a built-in flag to specify the API URL directly. However, based on the documentation, here are potential solutions: For the Node SDK, you can specify the EU endpoint like this:

const permit = new Permit({
  // the API key to the Permit environment you wish to connect to
  token: "<YOUR_API_KEY>",
  // the url in which the SDK can connect to the PDP container
  pdp: "<http://localhost:7766>",
  // use this to turn on sdk logs
  log: {
    level: "debug",
  },
  // the region in which the Permit environment is located
  apiUrl: "<https://api.eu.permit.io>",
}) ;

Unfortunately, the CLI documentation doesn't explicitly show how to configure the API URL for EU region when using

permit env export terraform

or

permit login

commands. (2) (3) (4) The CLI appears to default to the standard

<http://api.permit.io|api.permit.io>

endpoint. You might want to reach out to Permit.io support at Email for guidance on configuring the CLI for EU region, as this specific configuration isn't documented in the available sources.

To learn more, see the sources I considered: [[1] Using the API](https://docs.permit.io/api/api-with-cli) [[2] Environments management using the Permit CLI](https://docs.permit.io/how-to/permit-cli/permit-cli-envs) [[3] Permit CLI](https://github.com/permitio/permit-cli/blob/main/README.md) [[4] Policy - AI, Templates, OpenAPI](https://docs.permit.io/how-to/permit-cli/permit-cli-policy)

@Or Weis given it's open source - would you eventually appreciate a PR?

Seems @Eli Moshkovich jumped on the opportunity and produced a PR https://github.com/permitio/permit-cli/pull/137/files

Your feedback would be appreciated

It looks like you're encountering an authentication issue when trying to export Terraform configurations with the EU region. The "Invalid credentials" error suggests the API key isn't being properly passed to the EU endpoint. Based on the CLI documentation, the

permit env export terraform

command accepts an

--api-key

parameter (1) . When you're logged in via

permit login --region eu

, the CLI should be using the EU endpoint, but it seems the terraform export command might not be respecting the region setting from your login session. Here's what you can try: 1. ​*Verify your API key scope*​: The terraform export requires a project-level or higher API key . Make sure your API key has the correct permissions. 2. ​*Check if the region is being applied*​: Since you've successfully logged in with

--region eu

, the issue might be that the terraform export command isn't inheriting the region setting. The command structure should be:

permit env export terraform --api-key <your-api-key>

Since this appears to be a bug with the new EU region support that's being added via the PR you're testing, I'd recommend adding this feedback directly to the PR discussion. The terraform export command may need to be updated to respect the region setting established during login. For debugging purposes, could you share: 1. Which Workspace / Project / Env you are using 2. The exact command you're running (with the API key redacted) 3. Whether you're using a project-level or organization-level API key 4. Any error logs from the CLI when running with debug mode enabled This will help the team investigate the issue with the EU region support in the terraform export command.

To learn more, see the sources I considered: [[1] Environments management using the Permit CLI](https://docs.permit.io/how-to/permit-cli/permit-cli-envs)

The missing

admin

role in your Terraform export could be related to a known issue with the CLI's terraform export functionality (1) . According to the GitHub issue, the Terraform export has been reported to generate incomplete exports - it only generates roles and resource sets but misses the actual

permitio_condition_set_rule

resources that represent checked permissions in the policy matrix . The

permit env export terraform

command exports all environment content including resources, roles, user sets, resource sets, and condition sets in the Permit Terraform provider format (2) (3) . However, if your

admin

role has specific policy rules or condition set rules associated with it, these might not be getting exported correctly. Here's what the exported role should look like based on the Terraform provider documentation (4) :

resource "permitio_role" "admin" {
  key = "admin"
  name = "Administrator"
  description = "Full access to documents including deletion"
  permissions = ["document:read", "document:write", "document:delete"]
  
  depends_on = [permitio_resource.document]
}

To help troubleshoot this further, you could: 1. Check if the

admin

role appears correctly in the Permit.io dashboard 2. Try creating a simple test role to see if it exports properly 3. Review if the

admin

role has any special configurations that might be causing the export to skip it This appears to be a limitation of the current CLI export functionality rather than an issue with your specific setup.

To learn more, see the sources I considered: [[1] Bug: Missing Policy Rules in Terraform Export](https://github.com/permitio/permit-cli/issues/130) [[2] Environments management using the Permit CLI](https://docs.permit.io/how-to/permit-cli/permit-cli-envs) [[3] Permit CLI](https://github.com/permitio/permit-cli/blob/main/README.md) [[4] Permit.io Terraform Provider](https://docs.permit.io/integrations/infra-as-code/terraform-provider)

Looking at the Terraform provider documentation, there could be a few reasons why the

admin

role isn't being exported. The Terraform export functionality should export all roles defined in your environment (1) . Based on the Terraform provider examples, a properly exported admin role should look like this (2) :

resource "permitio_role" "admin" {
  key = "admin"
  name = "Administrator"
  description = "Full access to documents including deletion"
  permissions = ["document:read", "document:write", "document:delete"]
  
  depends_on = [permitio_resource.document]
}

The CLI's

permit env export terraform

command is designed to export all environment content including resources, roles, user sets, resource sets, and condition sets (1) . If the

admin

role appears correctly in your Permit.io dashboard but isn't being exported, this could be a bug in the export functionality. To help our engineers investigate this issue with the missing

admin

role in your Terraform export: 1. Which Workspace / Project / Env are you using? 2. Could you share the exact command you're running (with API key redacted) ? 3. Which version of the CLI are you running (since you're testing the PR branch) ? 4. Could you share any relevant logs from running the export command, perhaps with debug logging enabled? Additionally, it would be helpful to know: • Does the

admin

role have any permissions assigned in the policy matrix? • Are there any special characters in the role name or key? • Does the role have any dependencies on resources that might not be exporting? This information will help determine if this is related to the EU region changes or a separate export issue.

To learn more, see the sources I considered: [[1] Permit CLI](https://github.com/permitio/permit-cli/blob/main/README.md) [[2] Permit.io Terraform Provider](https://docs.permit.io/integrations/infra-as-code/terraform-provider)

Hi @Míla Votradovec , I was wrong about this being expected behavior. We've just pushed a fix that now exports all roles including admin/editor/viewer with their actual permissions. The CLI will now include them in your Terraform export, and the Terraform provider will handle updating existing roles automatically (standard UPSERT behavior). Pull the latest changes, rebuild, and your

admin

role should now appear in the export

One question here - it would be great if we could somehow manage tenants through terraform as well. In our setup, we need to create new new tenant rather often and switching from terraform to cli or custom script is a bit cumbersome

He'll be online in a few hours (west coast)

Hi @Míla Votradovec Good news - the new Terraform provider v0.0.18 has just been released, and it includes tenant management support! 🎉 You can now create and manage tenants directly through Terraform without needing to switch to CLI or scripts anymore.