EXTENSIONS

Zitadel for swamp, over its API: seven model types, one per resource, with the whole life cycle of each.

Non-destructive administration of a Zitadel instance over its Management API (v1 REST), authenticated with a JWT private-key service account. Reads orgs, projects, applications, users and managers. Creates OIDC/API applications and machine (service) users (idempotent); manages project roles and user grants, including the role-assertion flag that puts roles in tokens; creates PATs and machine keys, rotates client secrets; and deactivates or reactivates objects. Creates machine identities only, never human users. Two methods delete, both verify-first: removing a project role (roles cannot be deactivated) and revoking a PAT. Secrets are output once and marked sensitive.