Bump goauthentik.io/api/v3 from 3.2025041.1 to 3.2025060.1 (#700)

gergosimonyi · web-flow · commit 56454d194364 · 2025-06-18T12:43:14.000+02:00
Bumps [goauthentik.io/api/v3](https://github.com/goauthentik/client-go) from 3.2025041.1 to 3.2025060.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/goauthentik/client-go/releases">goauthentik.io/api/v3's releases</a>.</em></p> <blockquote> <h2>v3.2025060.1</h2> <p>Update API Client</p> <h4>What's Changed</h4> <hr /> <h5><code>GET</code> /policies/geoip/{policy_uuid}/</h5> <h6>Return Type:</h6> <p>Changed response : <strong>200 OK</strong></p> <ul> <li> <p>Changed content type : <code>application/json</code></p> <ul> <li>Changed property <code>countries</code> (array)</li> </ul> </li> </ul> <h5><code>PUT</code> /policies/geoip/{policy_uuid}/</h5> <h6>Request:</h6> <p>Changed content type : <code>application/json</code></p> <ul> <li>Changed property <code>countries</code> (array)</li> </ul> <h6>Return Type:</h6> <p>Changed response : <strong>200 OK</strong></p> <ul> <li> <p>Changed content type : <code>application/json</code></p> <ul> <li>Changed property <code>countries</code> (array)</li> </ul> </li> </ul> <h5><code>PATCH</code> /policies/geoip/{policy_uuid}/</h5> <h6>Request:</h6> <p>Changed content type : <code>application/json</code></p> <ul> <li>Changed property <code>countries</code> (array)</li> </ul> <h6>Return Type:</h6> <p>Changed response : <strong>200 OK</strong></p> <ul> <li>Changed content type : <code>application/json</code></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/goauthentik/client-go/commit/41821521317743d0b3ed88324a8daf940f10857d"><code>4182152</code></a> Update API Client</li> <li><a href="https://github.com/goauthentik/client-go/commit/a5af86e2e4fff5635b11b0f70f59d805bb49e32d"><code>a5af86e</code></a> Update API Client</li> <li><a href="https://github.com/goauthentik/client-go/commit/deb18c98fd699aabfb1485cf0ff22e5a444f8aea"><code>deb18c9</code></a> Update API Client</li> <li><a href="https://github.com/goauthentik/client-go/commit/b1a9051aba0ef55ae39d63d79bdb1d3bf7e16941"><code>b1a9051</code></a> Update API Client</li> <li><a href="https://github.com/goauthentik/client-go/commit/34c3be6215aac7e90057fe0205f8f33e6e0984e8"><code>34c3be6</code></a> separate make targets</li> <li><a href="https://github.com/goauthentik/client-go/commit/c9ea52f33ccfca9cc4921a6c86b4e1b556fff5dd"><code>c9ea52f</code></a> clone repo file instead of using raw.githubusercontent.com</li> <li>See full diff in <a href="https://github.com/goauthentik/client-go/compare/v3.2025041.1...v3.2025060.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=goauthentik.io/api/v3&package-manager=go_modules&previous-version=3.2025041.1&new-version=3.2025060.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
diff --git a/docs/data-sources/brand.md b/docs/data-sources/brand.md
@@ -32,6 +32,7 @@ data "authentik_brand" "authentik-default" {
 - `branding_favicon` (String) Generated.
 - `branding_logo` (String) Generated.
 - `branding_title` (String) Generated.
+- `client_certificates` (List of String)
 - `default` (Boolean) Generated.
 - `default_application` (String) Generated.
 - `domain` (String) Generated.
diff --git a/docs/resources/brand.md b/docs/resources/brand.md
@@ -36,6 +36,7 @@ resource "authentik_brand" "default" {
 - `branding_favicon` (String)
 - `branding_logo` (String)
 - `branding_title` (String) Defaults to `authentik`.
+- `client_certificates` (List of String)
 - `default` (Boolean) Defaults to `false`.
 - `default_application` (String)
 - `flow_authentication` (String)
diff --git a/docs/resources/policy_event_matcher.md b/docs/resources/policy_event_matcher.md
@@ -94,6 +94,7 @@ resource "authentik_policy_event_matcher" "name" {
   - `authentik.enterprise.providers.microsoft_entra`
   - `authentik.enterprise.providers.ssf`
   - `authentik.enterprise.stages.authenticator_endpoint_gdtc`
+  - `authentik.enterprise.stages.mtls`
   - `authentik.enterprise.stages.source`
   - `authentik.events`
 - `client_ip` (String)
@@ -196,6 +197,7 @@ resource "authentik_policy_event_matcher" "name" {
   - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`
   - `authentik_providers_ssf.ssfprovider`
   - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`
+  - `authentik_stages_mtls.mutualtlsstage`
   - `authentik_stages_source.sourcestage`
   - `authentik_events.event`
   - `authentik_events.notificationtransport`
diff --git a/docs/resources/rbac_permission_role.md b/docs/resources/rbac_permission_role.md
@@ -152,6 +152,7 @@ resource "authentik_rbac_permission_role" "global-permission" {
   - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`
   - `authentik_providers_ssf.ssfprovider`
   - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`
+  - `authentik_stages_mtls.mutualtlsstage`
   - `authentik_stages_source.sourcestage`
   - `authentik_events.event`
   - `authentik_events.notificationtransport`
diff --git a/docs/resources/rbac_permission_user.md b/docs/resources/rbac_permission_user.md
@@ -154,6 +154,7 @@ resource "authentik_rbac_permission_user" "global-permission" {
   - `authentik_providers_microsoft_entra.microsoftentraprovidermapping`
   - `authentik_providers_ssf.ssfprovider`
   - `authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage`
+  - `authentik_stages_mtls.mutualtlsstage`
   - `authentik_stages_source.sourcestage`
   - `authentik_events.event`
   - `authentik_events.notificationtransport`
diff --git a/docs/resources/source_ldap.md b/docs/resources/source_ldap.md
@@ -41,6 +41,7 @@ resource "authentik_source_ldap" "name" {
 
 - `additional_group_dn` (String) Defaults to ``.
 - `additional_user_dn` (String) Defaults to ``.
+- `delete_not_found_objects` (Boolean) Defaults to `false`.
 - `enabled` (Boolean) Defaults to `true`.
 - `group_membership_field` (String) Defaults to `member`.
 - `group_object_filter` (String) Defaults to `(objectClass=group)`.
@@ -55,6 +56,7 @@ resource "authentik_source_ldap" "name" {
 - `sync_parent_group` (String)
 - `sync_users` (Boolean) Defaults to `true`.
 - `sync_users_password` (Boolean) Defaults to `true`.
+- `user_membership_attribute` (String) Defaults to `distinguishedName`.
 - `user_object_filter` (String) Defaults to `(objectClass=person)`.
 - `user_path_template` (String) Defaults to `goauthentik.io/sources/%(slug)s`.
 - `uuid` (String) Generated.
diff --git a/docs/resources/stage_mutual_tls.md b/docs/resources/stage_mutual_tls.md
@@ -0,0 +1,48 @@
+---
+page_title: "authentik_stage_mutual_tls Resource - terraform-provider-authentik"
+subcategory: "Flows & Stages"
+description: |-
+  
+---
+
+# authentik_stage_mutual_tls (Resource)
+
+
+
+## Example Usage
+
+```terraform
+# Create a MutualTLS stage
+
+resource "authentik_stage_mutual_tls" "mtls" {
+  name = "mutual-tls"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String)
+
+### Optional
+
+- `cert_attribute` (String) Allowed values:
+  - `subject`
+  - `common_name`
+  - `email`
+ Defaults to `email`.
+- `certificate_authorities` (List of String)
+- `mode` (String) Allowed values:
+  - `optional`
+  - `required`
+ Defaults to `optional`.
+- `user_attribute` (String) Allowed values:
+  - `username`
+  - `email`
+ Defaults to `email`.
+
+### Read-Only
+
+- `id` (String) The ID of this resource.
diff --git a/examples/resources/authentik_stage_mutual_tls/resource.tf b/examples/resources/authentik_stage_mutual_tls/resource.tf
@@ -0,0 +1,5 @@
+# Create a MutualTLS stage
+
+resource "authentik_stage_mutual_tls" "mtls" {
+  name = "mutual-tls"
+}
diff --git a/go.mod b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/hashicorp/terraform-plugin-sdk v1.17.2
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0
 	github.com/stretchr/testify v1.10.0
-	goauthentik.io/api/v3 v3.2025041.1
+	goauthentik.io/api/v3 v3.2025062.1
 )
 
 require (
diff --git a/go.sum b/go.sum
@@ -454,8 +454,8 @@ go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC
 go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-goauthentik.io/api/v3 v3.2025041.1 h1:GAN6AoTmfnCGgx1SyM07jP4/LR/T3rkTEyShSBd3Co8=
-goauthentik.io/api/v3 v3.2025041.1/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
+goauthentik.io/api/v3 v3.2025062.1 h1:spvILDpDDWJNO3pM6QGqmryx6NvSchr1E8H60J/XUCA=
+goauthentik.io/api/v3 v3.2025062.1/go.mod h1:zz+mEZg8rY/7eEjkMGWJ2DnGqk+zqxuybGCGrR2O4Kw=
 golang.org/x/crypto v0.0.0-20190219172222-a4c6cb3142f2/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
diff --git a/pkg/provider/data_source_brand.go b/pkg/provider/data_source_brand.go
@@ -82,6 +82,13 @@ func dataSourceBrand() *schema.Resource {
 				Optional: true,
 				Computed: true,
 			},
+			"client_certificates": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
 			"default_application": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -124,6 +131,7 @@ func dataSourceBrandRead(ctx context.Context, d *schema.ResourceData, m interfac
 	setWrapper(d, "flow_user_settings", f.FlowUserSettings.Get())
 	setWrapper(d, "flow_device_code", f.FlowDeviceCode.Get())
 	setWrapper(d, "web_certificate", f.WebCertificate.Get())
+	setWrapper(d, "client_certificates", f.ClientCertificates)
 	setWrapper(d, "default_application", f.DefaultApplication.Get())
 	return diags
 }
diff --git a/pkg/provider/provider.go b/pkg/provider/provider.go
@@ -158,6 +158,7 @@ func Provider(version string, testing bool) *schema.Provider {
 			"authentik_stage_email":                       tr(resourceStageEmail),
 			"authentik_stage_identification":              tr(resourceStageIdentification),
 			"authentik_stage_invitation":                  tr(resourceStageInvitation),
+			"authentik_stage_mutual_tls":                  tr(resourceStageMutualTLS),
 			"authentik_stage_password":                    tr(resourceStagePassword),
 			"authentik_stage_prompt_field":                tr(resourceStagePromptField),
 			"authentik_stage_prompt":                      tr(resourceStagePrompt),
diff --git a/pkg/provider/resource_brand.go b/pkg/provider/resource_brand.go
@@ -80,6 +80,13 @@ func resourceBrand() *schema.Resource {
 				Type:     schema.TypeString,
 				Optional: true,
 			},
+			"client_certificates": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
 			"default_application": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -97,8 +104,9 @@ func resourceBrand() *schema.Resource {
 
 func resourceBrandSchemaToModel(d *schema.ResourceData) (*api.BrandRequest, diag.Diagnostics) {
 	m := api.BrandRequest{
-		Domain:  d.Get("domain").(string),
-		Default: api.PtrBool(d.Get("default").(bool)),
+		ClientCertificates: castSlice[string](d.Get("client_certificates").([]interface{})),
+		Domain:             d.Get("domain").(string),
+		Default:            api.PtrBool(d.Get("default").(bool)),
 	}
 
 	if l, ok := d.Get("branding_title").(string); ok {
@@ -229,6 +237,10 @@ func resourceBrandRead(ctx context.Context, d *schema.ResourceData, m interface{
 	if res.WebCertificate.IsSet() {
 		setWrapper(d, "web_certificate", res.WebCertificate.Get())
 	}
+	if res.HasClientCertificates() {
+		localClientCertificates := castSlice[string](d.Get("client_certificates").([]interface{}))
+		setWrapper(d, "client_certificates", listConsistentMerge(localClientCertificates, res.ClientCertificates))
+	}
 	if res.DefaultApplication.IsSet() {
 		setWrapper(d, "default_application", res.DefaultApplication.Get())
 	}
diff --git a/pkg/provider/resource_source_ldap.go b/pkg/provider/resource_source_ldap.go
@@ -85,6 +85,11 @@ func resourceSourceLDAP() *schema.Resource {
 				Optional: true,
 				Default:  "(objectClass=person)",
 			},
+			"user_membership_attribute": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Default:  "distinguishedName",
+			},
 			"group_object_filter": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -129,6 +134,11 @@ func resourceSourceLDAP() *schema.Resource {
 				Optional: true,
 				Default:  false,
 			},
+			"delete_not_found_objects": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+			},
 			"property_mappings": {
 				Type:     schema.TypeList,
 				Optional: true,
@@ -161,17 +171,19 @@ func resourceSourceLDAPSchemaToSource(d *schema.ResourceData) *api.LDAPSourceReq
 		StartTls:     api.PtrBool(d.Get("start_tls").(bool)),
 		Sni:          api.PtrBool(d.Get("sni").(bool)),
 
-		AdditionalUserDn:      api.PtrString(d.Get("additional_user_dn").(string)),
-		AdditionalGroupDn:     api.PtrString(d.Get("additional_group_dn").(string)),
-		UserObjectFilter:      api.PtrString(d.Get("user_object_filter").(string)),
-		GroupObjectFilter:     api.PtrString(d.Get("group_object_filter").(string)),
-		GroupMembershipField:  api.PtrString(d.Get("group_membership_field").(string)),
-		ObjectUniquenessField: api.PtrString(d.Get("object_uniqueness_field").(string)),
+		AdditionalUserDn:        api.PtrString(d.Get("additional_user_dn").(string)),
+		AdditionalGroupDn:       api.PtrString(d.Get("additional_group_dn").(string)),
+		UserObjectFilter:        api.PtrString(d.Get("user_object_filter").(string)),
+		UserMembershipAttribute: api.PtrString(d.Get("user_membership_attribute").(string)),
+		GroupObjectFilter:       api.PtrString(d.Get("group_object_filter").(string)),
+		GroupMembershipField:    api.PtrString(d.Get("group_membership_field").(string)),
+		ObjectUniquenessField:   api.PtrString(d.Get("object_uniqueness_field").(string)),
 
 		SyncUsers:                           api.PtrBool(d.Get("sync_users").(bool)),
 		SyncUsersPassword:                   api.PtrBool(d.Get("sync_users_password").(bool)),
 		SyncGroups:                          api.PtrBool(d.Get("sync_groups").(bool)),
 		PasswordLoginUpdateInternalPassword: api.PtrBool(d.Get("password_login_update_internal_password").(bool)),
+		DeleteNotFoundObjects:               api.PtrBool(d.Get("delete_not_found_objects").(bool)),
 		LookupGroupsFromUser:                api.PtrBool(d.Get("lookup_groups_from_user").(bool)),
 	}
 
@@ -221,6 +233,7 @@ func resourceSourceLDAPRead(ctx context.Context, d *schema.ResourceData, m inter
 	setWrapper(d, "additional_user_dn", res.AdditionalUserDn)
 	setWrapper(d, "additional_group_dn", res.AdditionalGroupDn)
 	setWrapper(d, "user_object_filter", res.UserObjectFilter)
+	setWrapper(d, "user_membership_attribute", res.UserMembershipAttribute)
 	setWrapper(d, "group_object_filter", res.GroupObjectFilter)
 	setWrapper(d, "group_membership_field", res.GroupMembershipField)
 	setWrapper(d, "object_uniqueness_field", res.ObjectUniquenessField)
@@ -229,6 +242,7 @@ func resourceSourceLDAPRead(ctx context.Context, d *schema.ResourceData, m inter
 	setWrapper(d, "sync_users_password", res.SyncUsersPassword)
 	setWrapper(d, "sync_groups", res.SyncGroups)
 	setWrapper(d, "password_login_update_internal_password", res.PasswordLoginUpdateInternalPassword)
+	setWrapper(d, "delete_not_found_objects", res.DeleteNotFoundObjects)
 	if res.SyncParentGroup.IsSet() {
 		setWrapper(d, "sync_parent_group", res.SyncParentGroup.Get())
 	}
diff --git a/pkg/provider/resource_stage_mutual_tls.go b/pkg/provider/resource_stage_mutual_tls.go
@@ -0,0 +1,122 @@
+package provider
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	api "goauthentik.io/api/v3"
+)
+
+func resourceStageMutualTLS() *schema.Resource {
+	return &schema.Resource{
+		Description:   "Flows & Stages --- ",
+		CreateContext: resourceStageMutualTLSCreate,
+		ReadContext:   resourceStageMutualTLSRead,
+		UpdateContext: resourceStageMutualTLSUpdate,
+		DeleteContext: resourceStageMutualTLSDelete,
+		Importer: &schema.ResourceImporter{
+			StateContext: schema.ImportStatePassthroughContext,
+		},
+		Schema: map[string]*schema.Schema{
+			"name": {
+				Type:     schema.TypeString,
+				Required: true,
+			},
+			"mode": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				Default:          api.MUTUALTLSSTAGEMODEENUM_OPTIONAL,
+				Description:      EnumToDescription(api.AllowedMutualTLSStageModeEnumEnumValues),
+				ValidateDiagFunc: StringInEnum(api.AllowedMutualTLSStageModeEnumEnumValues),
+			},
+			"cert_attribute": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				Default:          api.CERTATTRIBUTEENUM_EMAIL,
+				Description:      EnumToDescription(api.AllowedCertAttributeEnumEnumValues),
+				ValidateDiagFunc: StringInEnum(api.AllowedCertAttributeEnumEnumValues),
+			},
+			"user_attribute": {
+				Type:             schema.TypeString,
+				Optional:         true,
+				Default:          api.USERATTRIBUTEENUM_EMAIL,
+				Description:      EnumToDescription(api.AllowedUserAttributeEnumEnumValues),
+				ValidateDiagFunc: StringInEnum(api.AllowedUserAttributeEnumEnumValues),
+			},
+			"certificate_authorities": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Elem: &schema.Schema{
+					Type: schema.TypeString,
+				},
+			},
+		},
+	}
+}
+
+func resourceStageMutualTLSSchemaToProvider(d *schema.ResourceData) *api.MutualTLSStageRequest {
+	r := api.MutualTLSStageRequest{
+		Name:                   d.Get("name").(string),
+		Mode:                   api.MutualTLSStageModeEnum(d.Get("mode").(string)),
+		CertAttribute:          api.CertAttributeEnum(d.Get("cert_attribute").(string)),
+		UserAttribute:          api.UserAttributeEnum(d.Get("user_attribute").(string)),
+		CertificateAuthorities: castSlice[string](d.Get("certificate_authorities").([]interface{})),
+	}
+	return &r
+}
+
+func resourceStageMutualTLSCreate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	c := m.(*APIClient)
+
+	r := resourceStageMutualTLSSchemaToProvider(d)
+
+	res, hr, err := c.client.StagesApi.StagesMtlsCreate(ctx).MutualTLSStageRequest(*r).Execute()
+	if err != nil {
+		return httpToDiag(d, hr, err)
+	}
+
+	d.SetId(res.Pk)
+	return resourceStageMutualTLSRead(ctx, d, m)
+}
+
+func resourceStageMutualTLSRead(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	var diags diag.Diagnostics
+	c := m.(*APIClient)
+
+	res, hr, err := c.client.StagesApi.StagesMtlsRetrieve(ctx, d.Id()).Execute()
+	if err != nil {
+		return httpToDiag(d, hr, err)
+	}
+
+	setWrapper(d, "name", res.Name)
+	setWrapper(d, "mode", res.Mode)
+	setWrapper(d, "cert_attribute", res.CertAttribute)
+	setWrapper(d, "user_attribute", res.UserAttribute)
+	localCertificateAuthorities := castSlice[string](d.Get("certificate_authorities").([]interface{}))
+	setWrapper(d, "certificate_authorities", listConsistentMerge(localCertificateAuthorities, res.CertificateAuthorities))
+	return diags
+}
+
+func resourceStageMutualTLSUpdate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	c := m.(*APIClient)
+
+	app := resourceStageMutualTLSSchemaToProvider(d)
+
+	res, hr, err := c.client.StagesApi.StagesMtlsUpdate(ctx, d.Id()).MutualTLSStageRequest(*app).Execute()
+	if err != nil {
+		return httpToDiag(d, hr, err)
+	}
+
+	d.SetId(res.Pk)
+	return resourceStageMutualTLSRead(ctx, d, m)
+}
+
+func resourceStageMutualTLSDelete(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
+	c := m.(*APIClient)
+	hr, err := c.client.StagesApi.StagesMtlsDestroy(ctx, d.Id()).Execute()
+	if err != nil {
+		return httpToDiag(d, hr, err)
+	}
+	return diag.Diagnostics{}
+}
diff --git a/pkg/provider/resource_stage_mutual_tls_test.go b/pkg/provider/resource_stage_mutual_tls_test.go

Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,7 @@ require (`
`9`	`9`	`github.com/hashicorp/terraform-plugin-sdk v1.17.2`
`10`	`10`	`github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0`
`11`	`11`	`github.com/stretchr/testify v1.10.0`
`12`		`- goauthentik.io/api/v3 v3.2025041.1`
	`12`	`+ goauthentik.io/api/v3 v3.2025062.1`
`13`	`13`	`)`
`14`	`14`
`15`	`15`	`require (`