The refresh model

Pull once, then only on demand

TFsmith contacts your identity provider exactly twice, ever: once automatically when a tenant is first connected, and whenever someone clicks Refresh. That's the whole model. Opening the app, reloading the page, switching tenants, browsing types, exporting Terraform - none of it touches the provider API.

Why: admin API rate limits are real (and on Okta, shared org-wide). A tool you browse all day must not burn them. TFsmith treats your rate limit budget as yours, not its.

The stored export

Each pull saves the complete export to the data volume, encrypted with the tenant's data key - never plaintext at rest, never in the database. It survives restarts and upgrades. Everything you see and export comes from this stored copy.

Every user of the install shares it: in a Business install, ten people browsing costs the same provider API usage as one. Anyone (admin or user) can click Refresh to update it for everyone.

Knowing how fresh you are

Next to the Refresh button: "Last refreshed Today, 7/23/2026, 9:41 PM" (your local time; Yesterday and plain-date forms as it ages). Past seven days an amber note appears: Over a week since the last refresh - the tenant may have changed.

Rule of thumb: hit Refresh before exporting anything you are about to terraform plan - the plan compares against the LIVE tenant, so exporting from a stale copy shows up as unexpected diffs.