diff --git a/example/main.tf b/example/main.tf
index cba84f1..412efc5 100644
--- a/example/main.tf
+++ b/example/main.tf
@@ -14,18 +14,15 @@ provider "pomerium" {
   shared_secret_b64 = "9OkZR6hwfmVD3a7Sfmgq58lUbFJGGz4hl/R9xbHFCAg="
 }
 
-# resource "pomerium_namespace" "test_namespace" {
-#   name      = "test-namespace"
-#   parent_id = "9d8dbd2c-8cce-4e66-9c1f-c490b4a07243"
-# }
-
-locals {
-  namespace_id = "9d8dbd2c-8cce-4e66-9c1f-c490b4a07243"
+# Create resources
+resource "pomerium_namespace" "test_namespace" {
+  name      = "test-namespace"
+  parent_id = "9d8dbd2c-8cce-4e66-9c1f-c490b4a07243"
 }
 
 resource "pomerium_policy" "test_policy" {
   name         = "test-policy"
-  namespace_id = local.namespace_id
+  namespace_id = pomerium_namespace.test_namespace.id
   ppl          = <<EOF
 - allow:
     and:
@@ -35,8 +32,26 @@ EOF
 
 resource "pomerium_route" "test_route" {
   name         = "test-route"
-  namespace_id = local.namespace_id
+  namespace_id = pomerium_namespace.test_namespace.id
   from         = "https://verify-tf.localhost.pomerium.io"
   to           = ["https://verify.pomerium.com"]
   policies     = [pomerium_policy.test_policy.id]
 }
+
+# Data source examples
+data "pomerium_namespace" "existing_namespace" {
+  id = "9d8dbd2c-8cce-4e66-9c1f-c490b4a07243"
+}
+
+data "pomerium_route" "existing_route" {
+  id = pomerium_route.test_route.id
+}
+
+# Output examples
+output "namespace_name" {
+  value = data.pomerium_namespace.existing_namespace.name
+}
+
+output "route_from" {
+  value = data.pomerium_route.existing_route.from
+}
diff --git a/internal/provider/bootstrap_service_account.go b/internal/provider/bootstrap_service_account.go
index 3e8a581..b669e9d 100644
--- a/internal/provider/bootstrap_service_account.go
+++ b/internal/provider/bootstrap_service_account.go
@@ -11,7 +11,7 @@ import (
 	"google.golang.org/grpc/status"
 )
 
-func generateBootstrapServiceAccountToken(
+func GenerateBootstrapServiceAccountToken(
 	sharedSecretB64 string,
 ) (string, error) {
 	sharedSecret, err := base64.StdEncoding.DecodeString(sharedSecretB64)
diff --git a/internal/provider/bootstrap_service_account_test.go b/internal/provider/bootstrap_service_account_test.go
new file mode 100644
index 0000000..328b0c8
--- /dev/null
+++ b/internal/provider/bootstrap_service_account_test.go
@@ -0,0 +1,56 @@
+package provider_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/pomerium/enterprise-terraform-provider/internal/provider"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerateBootstrapServiceAccountToken(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name          string
+		sharedSecret  string
+		expectError   bool
+		validateToken func(t *testing.T, token string)
+	}{
+		{
+			name:         "invalid base64",
+			sharedSecret: "not-base64",
+			expectError:  true,
+		},
+		{
+			name:         "valid base64",
+			sharedSecret: "dGVzdC1zZWNyZXQ=", // "test-secret" in base64
+			expectError:  false,
+			validateToken: func(t *testing.T, token string) {
+				// JWT format: header.payload.signature
+				parts := strings.Split(token, ".")
+				require.Len(t, parts, 3)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			token, err := provider.GenerateBootstrapServiceAccountToken(tt.sharedSecret)
+			if tt.expectError {
+				assert.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.NotEmpty(t, token)
+
+			if tt.validateToken != nil {
+				tt.validateToken(t, token)
+			}
+		})
+	}
+}
diff --git a/internal/provider/helpers.go b/internal/provider/helpers.go
new file mode 100644
index 0000000..5b8747a
--- /dev/null
+++ b/internal/provider/helpers.go
@@ -0,0 +1,50 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	client "github.com/pomerium/enterprise-client-go"
+)
+
+// ConfigureClient is a helper to configure resources and data sources with the API client
+func ConfigureClient(req any, resp any) *client.Client {
+	var providerData any
+	switch r := req.(type) {
+	case datasource.ConfigureRequest:
+		providerData = r.ProviderData
+	case resource.ConfigureRequest:
+		providerData = r.ProviderData
+	}
+
+	if providerData == nil {
+		return nil
+	}
+
+	client, ok := providerData.(*client.Client)
+	if !ok {
+		switch r := resp.(type) {
+		case *datasource.ConfigureResponse:
+			r.Diagnostics.AddError(
+				"Unexpected Data Source Configure Type",
+				fmt.Sprintf("Expected *client.Client, got: %T.", providerData),
+			)
+		case *resource.ConfigureResponse:
+			r.Diagnostics.AddError(
+				"Unexpected Resource Configure Type",
+				fmt.Sprintf("Expected *client.Client, got: %T.", providerData),
+			)
+		}
+		return nil
+	}
+
+	return client
+}
+
+// ImportStatePassthroughID is a helper that implements the common import state pattern
+func ImportStatePassthroughID(req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resp.Diagnostics.Append(resp.State.SetAttribute(context.Background(), path.Root("id"), req.ID)...)
+}
diff --git a/internal/provider/helpers_test.go b/internal/provider/helpers_test.go
new file mode 100644
index 0000000..ca85a7a
--- /dev/null
+++ b/internal/provider/helpers_test.go
@@ -0,0 +1,87 @@
+package provider_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	client "github.com/pomerium/enterprise-client-go"
+	"github.com/pomerium/enterprise-terraform-provider/internal/provider"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestConfigureClient(t *testing.T) {
+	t.Parallel()
+
+	mockClient := &client.Client{}
+
+	tests := []struct {
+		name           string
+		req            any
+		resp           any
+		expectedClient *client.Client
+		expectError    bool
+	}{
+		{
+			name: "valid datasource request",
+			req: datasource.ConfigureRequest{
+				ProviderData: mockClient,
+			},
+			resp:           &datasource.ConfigureResponse{},
+			expectedClient: mockClient,
+			expectError:    false,
+		},
+		{
+			name: "valid resource request",
+			req: resource.ConfigureRequest{
+				ProviderData: mockClient,
+			},
+			resp:           &resource.ConfigureResponse{},
+			expectedClient: mockClient,
+			expectError:    false,
+		},
+		{
+			name: "nil provider data",
+			req: datasource.ConfigureRequest{
+				ProviderData: nil,
+			},
+			resp:           &datasource.ConfigureResponse{},
+			expectedClient: nil,
+			expectError:    false,
+		},
+		{
+			name: "invalid provider data type - datasource",
+			req: datasource.ConfigureRequest{
+				ProviderData: "invalid",
+			},
+			resp:           &datasource.ConfigureResponse{},
+			expectedClient: nil,
+			expectError:    true,
+		},
+		{
+			name: "invalid provider data type - resource",
+			req: resource.ConfigureRequest{
+				ProviderData: "invalid",
+			},
+			resp:           &resource.ConfigureResponse{},
+			expectedClient: nil,
+			expectError:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			client := provider.ConfigureClient(tt.req, tt.resp)
+			assert.Equal(t, tt.expectedClient, client)
+
+			switch resp := tt.resp.(type) {
+			case *datasource.ConfigureResponse:
+				assert.Equal(t, tt.expectError, resp.Diagnostics.HasError())
+			case *resource.ConfigureResponse:
+				assert.Equal(t, tt.expectError, resp.Diagnostics.HasError())
+			}
+		})
+	}
+}
diff --git a/internal/provider/models.go b/internal/provider/models.go
new file mode 100644
index 0000000..7a7f2a8
--- /dev/null
+++ b/internal/provider/models.go
@@ -0,0 +1,191 @@
+package provider
+
+import (
+	"context"
+	"time"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/pomerium/enterprise-client-go/pb"
+)
+
+// ServiceAccountModel represents the shared model for service account resources and data sources
+type ServiceAccountModel struct {
+	ID          types.String `tfsdk:"id"`
+	Name        types.String `tfsdk:"name"`
+	NamespaceID types.String `tfsdk:"namespace_id"`
+	Description types.String `tfsdk:"description"`
+	UserID      types.String `tfsdk:"user_id"`
+	ExpiresAt   types.String `tfsdk:"expires_at"`
+}
+
+func ConvertServiceAccountToPB(_ context.Context, src *ServiceAccountResourceModel) (*pb.PomeriumServiceAccount, diag.Diagnostics) {
+	var diagnostics diag.Diagnostics
+
+	namespaceID := src.NamespaceID.ValueString()
+	pbServiceAccount := &pb.PomeriumServiceAccount{
+		Id:          src.ID.ValueString(),
+		UserId:      src.Name.ValueString(),
+		NamespaceId: &namespaceID,
+	}
+
+	if !src.Description.IsNull() {
+		desc := src.Description.ValueString()
+		pbServiceAccount.Description = &desc
+	}
+
+	return pbServiceAccount, diagnostics
+}
+
+func ConvertServiceAccountFromPB(dst *ServiceAccountResourceModel, src *pb.PomeriumServiceAccount) diag.Diagnostics {
+	var diagnostics diag.Diagnostics
+
+	dst.ID = types.StringValue(src.Id)
+	dst.Name = types.StringValue(src.UserId)
+	if src.NamespaceId != nil {
+		dst.NamespaceID = types.StringValue(*src.NamespaceId)
+	} else {
+		dst.NamespaceID = types.StringNull()
+	}
+	if src.Description != nil {
+		dst.Description = types.StringValue(*src.Description)
+	} else {
+		dst.Description = types.StringNull()
+	}
+	dst.UserID = types.StringValue(src.UserId)
+	if src.ExpiresAt != nil {
+		dst.ExpiresAt = types.StringValue(src.ExpiresAt.AsTime().Format(time.RFC3339))
+	} else {
+		dst.ExpiresAt = types.StringNull()
+	}
+
+	return diagnostics
+}
+
+// NamespaceModel represents the shared model for namespace resources and data sources
+type NamespaceModel struct {
+	ID       types.String `tfsdk:"id"`
+	Name     types.String `tfsdk:"name"`
+	ParentID types.String `tfsdk:"parent_id"`
+}
+
+func ConvertNamespaceToPB(_ context.Context, src *NamespaceResourceModel) (*pb.Namespace, diag.Diagnostics) {
+	var diagnostics diag.Diagnostics
+
+	pbNamespace := &pb.Namespace{
+		Id:   src.ID.ValueString(),
+		Name: src.Name.ValueString(),
+	}
+
+	if !src.ParentID.IsNull() {
+		pbNamespace.ParentId = src.ParentID.ValueString()
+	}
+
+	return pbNamespace, diagnostics
+}
+
+func ConvertNamespaceFromPB(dst *NamespaceResourceModel, src *pb.Namespace) diag.Diagnostics {
+	var diagnostics diag.Diagnostics
+
+	dst.ID = types.StringValue(src.Id)
+	dst.Name = types.StringValue(src.Name)
+
+	if src.ParentId != "" {
+		dst.ParentID = types.StringValue(src.ParentId)
+	} else {
+		dst.ParentID = types.StringNull()
+	}
+
+	return diagnostics
+}
+
+// RouteModel represents the shared model for route resources and data sources
+type RouteModel struct {
+	ID          types.String `tfsdk:"id"`
+	Name        types.String `tfsdk:"name"`
+	From        types.String `tfsdk:"from"`
+	To          types.List   `tfsdk:"to"`
+	NamespaceID types.String `tfsdk:"namespace_id"`
+	Policies    types.List   `tfsdk:"policies"`
+}
+
+func ConvertRouteToPB(
+	ctx context.Context,
+	src *RouteResourceModel,
+) (*pb.Route, diag.Diagnostics) {
+	pbRoute := new(pb.Route)
+	var diagnostics diag.Diagnostics
+
+	pbRoute.Id = src.ID.ValueString()
+	pbRoute.Name = src.Name.ValueString()
+	pbRoute.From = src.From.ValueString()
+	pbRoute.NamespaceId = src.NamespaceID.ValueString()
+
+	diags := src.To.ElementsAs(ctx, &pbRoute.To, false)
+	diagnostics.Append(diags...)
+
+	if !src.Policies.IsNull() {
+		diags = src.Policies.ElementsAs(ctx, &pbRoute.PolicyIds, false)
+		diagnostics.Append(diags...)
+	}
+	return pbRoute, diagnostics
+}
+
+func ConvertRouteFromPB(
+	dst *RouteResourceModel,
+	src *pb.Route,
+) diag.Diagnostics {
+	var diagnostics diag.Diagnostics
+
+	dst.ID = types.StringValue(src.Id)
+	dst.Name = types.StringValue(src.Name)
+	dst.From = types.StringValue(src.From)
+	dst.NamespaceID = types.StringValue(src.NamespaceId)
+
+	toList := make([]attr.Value, len(src.To))
+	for i, v := range src.To {
+		toList[i] = types.StringValue(v)
+	}
+	dst.To = types.ListValueMust(types.StringType, toList)
+
+	policiesList := make([]attr.Value, len(src.PolicyIds))
+	for i, v := range src.PolicyIds {
+		policiesList[i] = types.StringValue(v)
+	}
+	dst.Policies = types.ListValueMust(types.StringType, policiesList)
+
+	return diagnostics
+}
+
+// PolicyModel represents the shared model for policy resources and data sources
+type PolicyModel struct {
+	ID          types.String `tfsdk:"id"`
+	Name        types.String `tfsdk:"name"`
+	NamespaceID types.String `tfsdk:"namespace_id"`
+	PPL         types.String `tfsdk:"ppl"`
+}
+
+func ConvertPolicyToPB(_ context.Context, src *PolicyResourceModel) (*pb.Policy, diag.Diagnostics) {
+	var diagnostics diag.Diagnostics
+
+	pbPolicy := &pb.Policy{
+		Id:          src.ID.ValueString(),
+		Name:        src.Name.ValueString(),
+		NamespaceId: src.NamespaceID.ValueString(),
+		Ppl:         src.PPL.ValueString(),
+	}
+
+	return pbPolicy, diagnostics
+}
+
+func ConvertPolicyFromPB(dst *PolicyResourceModel, src *pb.Policy) diag.Diagnostics {
+	var diagnostics diag.Diagnostics
+
+	dst.ID = types.StringValue(src.Id)
+	dst.Name = types.StringValue(src.Name)
+	dst.NamespaceID = types.StringValue(src.NamespaceId)
+	dst.PPL = types.StringValue(src.Ppl)
+
+	return diagnostics
+}
diff --git a/internal/provider/namespace.go b/internal/provider/namespace.go
index d4a66c4..4dddd5e 100644
--- a/internal/provider/namespace.go
+++ b/internal/provider/namespace.go
@@ -2,10 +2,7 @@ package provider
 
 import (
 	"context"
-	"fmt"
 
-	"github.com/hashicorp/terraform-plugin-framework/diag"
-	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
@@ -34,11 +31,7 @@ type NamespaceResource struct {
 }
 
 // NamespaceResourceModel describes the resource data model.
-type NamespaceResourceModel struct {
-	ID       types.String `tfsdk:"id"`
-	Name     types.String `tfsdk:"name"`
-	ParentID types.String `tfsdk:"parent_id"`
-}
+type NamespaceResourceModel = NamespaceModel
 
 func (r *NamespaceResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
 	resp.TypeName = req.ProviderTypeName + "_namespace"
@@ -46,8 +39,7 @@ func (r *NamespaceResource) Metadata(_ context.Context, req resource.MetadataReq
 
 func (r *NamespaceResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
 	resp.Schema = schema.Schema{
-		MarkdownDescription: "Namespace resource for Pomerium.",
-
+		MarkdownDescription: "Namespace for Pomerium.",
 		Attributes: map[string]schema.Attribute{
 			"id": schema.StringAttribute{
 				Computed:    true,
@@ -69,20 +61,7 @@ func (r *NamespaceResource) Schema(_ context.Context, _ resource.SchemaRequest,
 }
 
 func (r *NamespaceResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
-	if req.ProviderData == nil {
-		return
-	}
-
-	c, ok := req.ProviderData.(*client.Client)
-	if !ok {
-		resp.Diagnostics.AddError(
-			"Unexpected Provider Data Type",
-			fmt.Sprintf("Expected *client.Client, got: %T.", req.ProviderData),
-		)
-		return
-	}
-
-	r.client = c
+	r.client = ConfigureClient(req, resp)
 }
 
 func (r *NamespaceResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
@@ -186,36 +165,6 @@ func (r *NamespaceResource) Delete(ctx context.Context, req resource.DeleteReque
 	resp.State.RemoveResource(ctx)
 }
 
-func (r *NamespaceResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
-	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
-}
-
-func ConvertNamespaceToPB(_ context.Context, src *NamespaceResourceModel) (*pb.Namespace, diag.Diagnostics) {
-	var diagnostics diag.Diagnostics
-
-	pbNamespace := &pb.Namespace{
-		Id:   src.ID.ValueString(),
-		Name: src.Name.ValueString(),
-	}
-
-	if !src.ParentID.IsNull() {
-		pbNamespace.ParentId = src.ParentID.ValueString()
-	}
-
-	return pbNamespace, diagnostics
-}
-
-func ConvertNamespaceFromPB(dst *NamespaceResourceModel, src *pb.Namespace) diag.Diagnostics {
-	var diagnostics diag.Diagnostics
-
-	dst.ID = types.StringValue(src.Id)
-	dst.Name = types.StringValue(src.Name)
-
-	if src.ParentId != "" {
-		dst.ParentID = types.StringValue(src.ParentId)
-	} else {
-		dst.ParentID = types.StringNull()
-	}
-
-	return diagnostics
+func (r *NamespaceResource) ImportState(_ context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	ImportStatePassthroughID(req, resp)
 }
diff --git a/internal/provider/namespace_data_source.go b/internal/provider/namespace_data_source.go
new file mode 100644
index 0000000..867daeb
--- /dev/null
+++ b/internal/provider/namespace_data_source.go
@@ -0,0 +1,74 @@
+package provider
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+
+	client "github.com/pomerium/enterprise-client-go"
+	"github.com/pomerium/enterprise-client-go/pb"
+)
+
+var _ datasource.DataSource = &NamespaceDataSource{}
+
+func NewNamespaceDataSource() datasource.DataSource {
+	return &NamespaceDataSource{}
+}
+
+type NamespaceDataSource struct {
+	client *client.Client
+}
+
+func (d *NamespaceDataSource) Metadata(_ context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_namespace"
+}
+
+func (d *NamespaceDataSource) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "Namespace for Pomerium.",
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{
+				Required:    true,
+				Description: "Unique identifier for the namespace.",
+			},
+			"name": schema.StringAttribute{
+				Computed:    true,
+				Description: "Name of the namespace.",
+			},
+			"parent_id": schema.StringAttribute{
+				Computed:    true,
+				Description: "ID of the parent namespace.",
+			},
+		},
+	}
+}
+
+func (d *NamespaceDataSource) Configure(_ context.Context, req datasource.ConfigureRequest, resp *datasource.ConfigureResponse) {
+	d.client = ConfigureClient(req, resp)
+}
+
+func (d *NamespaceDataSource) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
+	var data NamespaceModel
+
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	namespaceResp, err := d.client.NamespaceService.GetNamespace(ctx, &pb.GetNamespaceRequest{
+		Id: data.ID.ValueString(),
+	})
+	if err != nil {
+		resp.Diagnostics.AddError("Error reading namespace", err.Error())
+		return
+	}
+
+	diags := ConvertNamespaceFromPB(&data, namespaceResp.Namespace)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
diff --git a/internal/provider/namespaces_data_source.go b/internal/provider/namespaces_data_source.go
new file mode 100644
index 0000000..8398091
--- /dev/null
+++ b/internal/provider/namespaces_data_source.go
@@ -0,0 +1,102 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+
+	client "github.com/pomerium/enterprise-client-go"
+	"github.com/pomerium/enterprise-client-go/pb"
+)
+
+var _ datasource.DataSource = &NamespacesDataSource{}
+
+func NewNamespacesDataSource() datasource.DataSource {
+	return &NamespacesDataSource{}
+}
+
+type NamespacesDataSource struct {
+	client *client.Client
+}
+
+type NamespacesDataSourceModel struct {
+	Namespaces []NamespaceModel `tfsdk:"namespaces"`
+}
+
+func (d *NamespacesDataSource) Metadata(_ context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_namespaces"
+}
+
+func (d *NamespacesDataSource) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "List all namespaces",
+
+		Attributes: map[string]schema.Attribute{
+			"namespaces": schema.ListNestedAttribute{
+				Computed: true,
+				NestedObject: schema.NestedAttributeObject{
+					Attributes: map[string]schema.Attribute{
+						"id": schema.StringAttribute{
+							Computed:    true,
+							Description: "Unique identifier for the namespace.",
+						},
+						"name": schema.StringAttribute{
+							Computed:    true,
+							Description: "Name of the namespace.",
+						},
+						"parent_id": schema.StringAttribute{
+							Computed:    true,
+							Description: "ID of the parent namespace.",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func (d *NamespacesDataSource) Configure(_ context.Context, req datasource.ConfigureRequest, resp *datasource.ConfigureResponse) {
+	if req.ProviderData == nil {
+		return
+	}
+
+	client, ok := req.ProviderData.(*client.Client)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected Data Source Configure Type",
+			fmt.Sprintf("Expected *client.Client, got: %T.", req.ProviderData),
+		)
+		return
+	}
+
+	d.client = client
+}
+
+func (d *NamespacesDataSource) Read(ctx context.Context, _ datasource.ReadRequest, resp *datasource.ReadResponse) {
+	var data NamespacesDataSourceModel
+
+	namespacesResp, err := d.client.NamespaceService.ListNamespaces(ctx, &pb.ListNamespacesRequest{})
+	if err != nil {
+		resp.Diagnostics.AddError("Error reading namespaces", err.Error())
+		return
+	}
+
+	namespaces := make([]NamespaceModel, 0, len(namespacesResp.Namespaces))
+	for _, ns := range namespacesResp.Namespaces {
+		var namespace NamespaceModel
+		namespace.ID = types.StringValue(ns.Id)
+		namespace.Name = types.StringValue(ns.Name)
+		if ns.ParentId != "" {
+			namespace.ParentID = types.StringValue(ns.ParentId)
+		} else {
+			namespace.ParentID = types.StringNull()
+		}
+		namespaces = append(namespaces, namespace)
+	}
+
+	data.Namespaces = namespaces
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
diff --git a/internal/provider/policies_data_source.go b/internal/provider/policies_data_source.go
new file mode 100644
index 0000000..5ffaa08
--- /dev/null
+++ b/internal/provider/policies_data_source.go
@@ -0,0 +1,103 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+
+	client "github.com/pomerium/enterprise-client-go"
+	"github.com/pomerium/enterprise-client-go/pb"
+)
+
+var _ datasource.DataSource = &PoliciesDataSource{}
+
+func NewPoliciesDataSource() datasource.DataSource {
+	return &PoliciesDataSource{}
+}
+
+type PoliciesDataSource struct {
+	client *client.Client
+}
+
+type PoliciesDataSourceModel struct {
+	Policies []PolicyModel `tfsdk:"policies"`
+}
+
+func (d *PoliciesDataSource) Metadata(_ context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_policies"
+}
+
+func (d *PoliciesDataSource) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "List all policies",
+
+		Attributes: map[string]schema.Attribute{
+			"policies": schema.ListNestedAttribute{
+				Computed: true,
+				NestedObject: schema.NestedAttributeObject{
+					Attributes: map[string]schema.Attribute{
+						"id": schema.StringAttribute{
+							Computed:    true,
+							Description: "Unique identifier for the policy.",
+						},
+						"name": schema.StringAttribute{
+							Computed:    true,
+							Description: "Name of the policy.",
+						},
+						"namespace_id": schema.StringAttribute{
+							Computed:    true,
+							Description: "ID of the namespace the policy belongs to.",
+						},
+						"ppl": schema.StringAttribute{
+							Computed:    true,
+							Description: "Policy Policy Language (PPL) string.",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func (d *PoliciesDataSource) Configure(_ context.Context, req datasource.ConfigureRequest, resp *datasource.ConfigureResponse) {
+	if req.ProviderData == nil {
+		return
+	}
+
+	client, ok := req.ProviderData.(*client.Client)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected Data Source Configure Type",
+			fmt.Sprintf("Expected *client.Client, got: %T.", req.ProviderData),
+		)
+		return
+	}
+
+	d.client = client
+}
+
+func (d *PoliciesDataSource) Read(ctx context.Context, _ datasource.ReadRequest, resp *datasource.ReadResponse) {
+	var data PoliciesDataSourceModel
+
+	policiesResp, err := d.client.PolicyService.ListPolicies(ctx, &pb.ListPoliciesRequest{})
+	if err != nil {
+		resp.Diagnostics.AddError("Error reading policies", err.Error())
+		return
+	}
+
+	policies := make([]PolicyModel, 0, len(policiesResp.Policies))
+	for _, policy := range policiesResp.Policies {
+		var policyModel PolicyModel
+		diags := ConvertPolicyFromPB(&policyModel, policy)
+		if diags.HasError() {
+			resp.Diagnostics.Append(diags...)
+			return
+		}
+		policies = append(policies, policyModel)
+	}
+
+	data.Policies = policies
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
diff --git a/internal/provider/policy.go b/internal/provider/policy.go
index 4b07cb0..c6f2904 100644
--- a/internal/provider/policy.go
+++ b/internal/provider/policy.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -34,12 +33,7 @@ type PolicyResource struct {
 }
 
 // PolicyResourceModel describes the resource data model.
-type PolicyResourceModel struct {
-	ID          types.String `tfsdk:"id"`
-	Name        types.String `tfsdk:"name"`
-	NamespaceID types.String `tfsdk:"namespace_id"`
-	PPL         types.String `tfsdk:"ppl"`
-}
+type PolicyResourceModel = PolicyModel
 
 func (r *PolicyResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
 	resp.TypeName = req.ProviderTypeName + "_policy"
@@ -47,8 +41,7 @@ func (r *PolicyResource) Metadata(_ context.Context, req resource.MetadataReques
 
 func (r *PolicyResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
 	resp.Schema = schema.Schema{
-		MarkdownDescription: "Policy resource for Pomerium.",
-
+		MarkdownDescription: "Policy for Pomerium.",
 		Attributes: map[string]schema.Attribute{
 			"id": schema.StringAttribute{
 				Computed:    true,
@@ -195,27 +188,3 @@ func (r *PolicyResource) ImportState(ctx context.Context, req resource.ImportSta
 	// Import by ID
 	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
 }
-
-func ConvertPolicyToPB(_ context.Context, src *PolicyResourceModel) (*pb.Policy, diag.Diagnostics) {
-	var diagnostics diag.Diagnostics
-
-	pbPolicy := &pb.Policy{
-		Id:          src.ID.ValueString(),
-		Name:        src.Name.ValueString(),
-		NamespaceId: src.NamespaceID.ValueString(),
-		Ppl:         src.PPL.ValueString(),
-	}
-
-	return pbPolicy, diagnostics
-}
-
-func ConvertPolicyFromPB(dst *PolicyResourceModel, src *pb.Policy) diag.Diagnostics {
-	var diagnostics diag.Diagnostics
-
-	dst.ID = types.StringValue(src.Id)
-	dst.Name = types.StringValue(src.Name)
-	dst.NamespaceID = types.StringValue(src.NamespaceId)
-	dst.PPL = types.StringValue(src.Ppl)
-
-	return diagnostics
-}
diff --git a/internal/provider/policy_data_source.go b/internal/provider/policy_data_source.go
new file mode 100644
index 0000000..94092b5
--- /dev/null
+++ b/internal/provider/policy_data_source.go
@@ -0,0 +1,92 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+
+	client "github.com/pomerium/enterprise-client-go"
+	"github.com/pomerium/enterprise-client-go/pb"
+)
+
+var _ datasource.DataSource = &PolicyDataSource{}
+
+func NewPolicyDataSource() datasource.DataSource {
+	return &PolicyDataSource{}
+}
+
+type PolicyDataSource struct {
+	client *client.Client
+}
+
+func (d *PolicyDataSource) Metadata(_ context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_policy"
+}
+
+func (d *PolicyDataSource) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "Policy for Pomerium.",
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{
+				Required:    true,
+				Description: "Unique identifier for the policy.",
+			},
+			"name": schema.StringAttribute{
+				Computed:    true,
+				Description: "Name of the policy.",
+			},
+			"namespace_id": schema.StringAttribute{
+				Computed:    true,
+				Description: "ID of the namespace the policy belongs to.",
+			},
+			"ppl": schema.StringAttribute{
+				Computed:    true,
+				Description: "Policy Policy Language (PPL) string.",
+			},
+		},
+	}
+}
+
+func (d *PolicyDataSource) Configure(_ context.Context, req datasource.ConfigureRequest, resp *datasource.ConfigureResponse) {
+	if req.ProviderData == nil {
+		return
+	}
+
+	client, ok := req.ProviderData.(*client.Client)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected Data Source Configure Type",
+			fmt.Sprintf("Expected *client.Client, got: %T.", req.ProviderData),
+		)
+		return
+	}
+
+	d.client = client
+}
+
+func (d *PolicyDataSource) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
+	var data PolicyModel
+
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	policyResp, err := d.client.PolicyService.GetPolicy(ctx, &pb.GetPolicyRequest{
+		Id: data.ID.ValueString(),
+	})
+	if err != nil {
+		resp.Diagnostics.AddError("Error reading policy", err.Error())
+		return
+	}
+
+	diags := ConvertPolicyFromPB(&data, policyResp.Policy)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
diff --git a/internal/provider/provider.go b/internal/provider/provider.go
index 38f917b..a7dadde 100644
--- a/internal/provider/provider.go
+++ b/internal/provider/provider.go
@@ -99,7 +99,7 @@ func (p *PomeriumProvider) Configure(ctx context.Context, req provider.Configure
 	if !data.ServiceAccountToken.IsNull() {
 		token = data.ServiceAccountToken.ValueString()
 	} else if !data.SharedSecretB64.IsNull() {
-		token, err = generateBootstrapServiceAccountToken(data.SharedSecretB64.ValueString())
+		token, err = GenerateBootstrapServiceAccountToken(data.SharedSecretB64.ValueString())
 		if err != nil {
 			resp.Diagnostics.AddError("failed to decode shared_secret_b64", err.Error())
 			return
@@ -122,11 +122,21 @@ func (p *PomeriumProvider) Resources(_ context.Context) []func() resource.Resour
 		NewNamespaceResource,
 		NewRouteResource,
 		NewPolicyResource,
+		NewServiceAccountResource,
 	}
 }
 
 func (p *PomeriumProvider) DataSources(_ context.Context) []func() datasource.DataSource {
-	return []func() datasource.DataSource{}
+	return []func() datasource.DataSource{
+		NewServiceAccountDataSource,
+		NewServiceAccountsDataSource,
+		NewRouteDataSource,
+		NewRoutesDataSource,
+		NewNamespaceDataSource,
+		NewNamespacesDataSource,
+		NewPolicyDataSource,
+		NewPoliciesDataSource,
+	}
 }
 
 func (p *PomeriumProvider) Functions(_ context.Context) []func() function.Function {
diff --git a/internal/provider/route.go b/internal/provider/route.go
index 2c53875..0aedca3 100644
--- a/internal/provider/route.go
+++ b/internal/provider/route.go
@@ -4,8 +4,6 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/hashicorp/terraform-plugin-framework/attr"
-	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -33,14 +31,7 @@ type RouteResource struct {
 }
 
 // RouteResourceModel describes the resource data model.
-type RouteResourceModel struct {
-	From        types.String `tfsdk:"from"`
-	To          types.List   `tfsdk:"to"`
-	Name        types.String `tfsdk:"name"`
-	ID          types.String `tfsdk:"id"`
-	NamespaceID types.String `tfsdk:"namespace_id"`
-	Policies    types.List   `tfsdk:"policies"`
-}
+type RouteResourceModel = RouteModel
 
 func (r *RouteResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
 	resp.TypeName = req.ProviderTypeName + "_route"
@@ -48,37 +39,35 @@ func (r *RouteResource) Metadata(_ context.Context, req resource.MetadataRequest
 
 func (r *RouteResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
 	resp.Schema = schema.Schema{
-		// This description is used by the documentation generator and the language server.
-		MarkdownDescription: "Route",
-
+		MarkdownDescription: "Route for Pomerium.",
 		Attributes: map[string]schema.Attribute{
 			"id": schema.StringAttribute{
 				Computed:    true,
-				Description: "Route ID",
+				Description: "Unique identifier for the route.",
 				PlanModifiers: []planmodifier.String{
 					stringplanmodifier.UseStateForUnknown(),
 				},
 			},
 			"name": schema.StringAttribute{
-				Description: "Route name",
+				Description: "Name of the route.",
 				Required:    true,
 			},
 			"from": schema.StringAttribute{
-				Description: "From URL",
+				Description: "From URL.",
 				Required:    true,
 			},
 			"to": schema.ListAttribute{
 				ElementType: types.StringType,
-				Description: "To URL",
+				Description: "To URLs.",
 				Required:    true,
 			},
 			"namespace_id": schema.StringAttribute{
-				Description: "ID of the namespace the route belongs to",
+				Description: "ID of the namespace the route belongs to.",
 				Required:    true,
 			},
 			"policies": schema.ListAttribute{
 				ElementType: types.StringType,
-				Description: "List of policy IDs to associate with the route",
+				Description: "List of policy IDs associated with the route.",
 				Optional:    true,
 			},
 		},
@@ -208,51 +197,3 @@ func (r *RouteResource) Delete(ctx context.Context, req resource.DeleteRequest,
 func (r *RouteResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
 	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
 }
-
-func ConvertRouteToPB(
-	ctx context.Context,
-	src *RouteResourceModel,
-) (*pb.Route, diag.Diagnostics) {
-	pbRoute := new(pb.Route)
-	var diagnostics diag.Diagnostics
-
-	pbRoute.Id = src.ID.ValueString()
-	pbRoute.Name = src.Name.ValueString()
-	pbRoute.From = src.From.ValueString()
-	pbRoute.NamespaceId = src.NamespaceID.ValueString()
-
-	diags := src.To.ElementsAs(ctx, &pbRoute.To, false)
-	diagnostics.Append(diags...)
-
-	if !src.Policies.IsNull() {
-		diags = src.Policies.ElementsAs(ctx, &pbRoute.PolicyIds, false)
-		diagnostics.Append(diags...)
-	}
-	return pbRoute, diagnostics
-}
-
-func ConvertRouteFromPB(
-	dst *RouteResourceModel,
-	src *pb.Route,
-) diag.Diagnostics {
-	var diagnostics diag.Diagnostics
-
-	dst.ID = types.StringValue(src.Id)
-	dst.Name = types.StringValue(src.Name)
-	dst.From = types.StringValue(src.From)
-	dst.NamespaceID = types.StringValue(src.NamespaceId)
-
-	toList := make([]attr.Value, len(src.To))
-	for i, v := range src.To {
-		toList[i] = types.StringValue(v)
-	}
-	dst.To = types.ListValueMust(types.StringType, toList)
-
-	policiesList := make([]attr.Value, len(src.PolicyIds))
-	for i, v := range src.PolicyIds {
-		policiesList[i] = types.StringValue(v)
-	}
-	dst.Policies = types.ListValueMust(types.StringType, policiesList)
-
-	return diagnostics
-}
diff --git a/internal/provider/route_data_source.go b/internal/provider/route_data_source.go
new file mode 100644
index 0000000..8cf8db9
--- /dev/null
+++ b/internal/provider/route_data_source.go
@@ -0,0 +1,104 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+
+	client "github.com/pomerium/enterprise-client-go"
+	"github.com/pomerium/enterprise-client-go/pb"
+)
+
+var _ datasource.DataSource = &RouteDataSource{}
+
+func NewRouteDataSource() datasource.DataSource {
+	return &RouteDataSource{}
+}
+
+type RouteDataSource struct {
+	client *client.Client
+}
+
+func (d *RouteDataSource) Metadata(_ context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_route"
+}
+
+func (d *RouteDataSource) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "Route data source",
+
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{
+				Required:    true,
+				Description: "Unique identifier for the route.",
+			},
+			"name": schema.StringAttribute{
+				Computed:    true,
+				Description: "Name of the route.",
+			},
+			"from": schema.StringAttribute{
+				Computed:    true,
+				Description: "From URL.",
+			},
+			"to": schema.ListAttribute{
+				Computed:    true,
+				ElementType: types.StringType,
+				Description: "To URLs.",
+			},
+			"namespace_id": schema.StringAttribute{
+				Computed:    true,
+				Description: "ID of the namespace the route belongs to.",
+			},
+			"policies": schema.ListAttribute{
+				Computed:    true,
+				ElementType: types.StringType,
+				Description: "List of policy IDs associated with the route.",
+			},
+		},
+	}
+}
+
+func (d *RouteDataSource) Configure(_ context.Context, req datasource.ConfigureRequest, resp *datasource.ConfigureResponse) {
+	if req.ProviderData == nil {
+		return
+	}
+
+	client, ok := req.ProviderData.(*client.Client)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected Data Source Configure Type",
+			fmt.Sprintf("Expected *client.Client, got: %T.", req.ProviderData),
+		)
+		return
+	}
+
+	d.client = client
+}
+
+func (d *RouteDataSource) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
+	var data RouteModel
+
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	routeResp, err := d.client.RouteService.GetRoute(ctx, &pb.GetRouteRequest{
+		Id: data.ID.ValueString(),
+	})
+	if err != nil {
+		resp.Diagnostics.AddError("Error reading route", err.Error())
+		return
+	}
+
+	diags := ConvertRouteFromPB(&data, routeResp.Route)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
diff --git a/internal/provider/routes_data_source.go b/internal/provider/routes_data_source.go
new file mode 100644
index 0000000..c3b2f73
--- /dev/null
+++ b/internal/provider/routes_data_source.go
@@ -0,0 +1,114 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+
+	client "github.com/pomerium/enterprise-client-go"
+	"github.com/pomerium/enterprise-client-go/pb"
+)
+
+var _ datasource.DataSource = &RoutesDataSource{}
+
+func NewRoutesDataSource() datasource.DataSource {
+	return &RoutesDataSource{}
+}
+
+type RoutesDataSource struct {
+	client *client.Client
+}
+
+type RoutesDataSourceModel struct {
+	Routes []RouteModel `tfsdk:"routes"`
+}
+
+func (d *RoutesDataSource) Metadata(_ context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_routes"
+}
+
+func (d *RoutesDataSource) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "List all routes",
+
+		Attributes: map[string]schema.Attribute{
+			"routes": schema.ListNestedAttribute{
+				Computed: true,
+				NestedObject: schema.NestedAttributeObject{
+					Attributes: map[string]schema.Attribute{
+						"id": schema.StringAttribute{
+							Computed:    true,
+							Description: "Unique identifier for the route.",
+						},
+						"name": schema.StringAttribute{
+							Computed:    true,
+							Description: "Name of the route.",
+						},
+						"from": schema.StringAttribute{
+							Computed:    true,
+							Description: "From URL.",
+						},
+						"to": schema.ListAttribute{
+							Computed:    true,
+							ElementType: types.StringType,
+							Description: "To URLs.",
+						},
+						"namespace_id": schema.StringAttribute{
+							Computed:    true,
+							Description: "ID of the namespace the route belongs to.",
+						},
+						"policies": schema.ListAttribute{
+							Computed:    true,
+							ElementType: types.StringType,
+							Description: "List of policy IDs associated with the route.",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func (d *RoutesDataSource) Configure(_ context.Context, req datasource.ConfigureRequest, resp *datasource.ConfigureResponse) {
+	if req.ProviderData == nil {
+		return
+	}
+
+	client, ok := req.ProviderData.(*client.Client)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected Data Source Configure Type",
+			fmt.Sprintf("Expected *client.Client, got: %T.", req.ProviderData),
+		)
+		return
+	}
+
+	d.client = client
+}
+
+func (d *RoutesDataSource) Read(ctx context.Context, _ datasource.ReadRequest, resp *datasource.ReadResponse) {
+	var data RoutesDataSourceModel
+
+	routesResp, err := d.client.RouteService.ListRoutes(ctx, &pb.ListRoutesRequest{})
+	if err != nil {
+		resp.Diagnostics.AddError("Error reading routes", err.Error())
+		return
+	}
+
+	routes := make([]RouteModel, 0, len(routesResp.Routes))
+	for _, route := range routesResp.Routes {
+		var routeModel RouteModel
+		diags := ConvertRouteFromPB(&routeModel, route)
+		if diags.HasError() {
+			resp.Diagnostics.Append(diags...)
+			return
+		}
+		routes = append(routes, routeModel)
+	}
+
+	data.Routes = routes
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
diff --git a/internal/provider/service_account.go b/internal/provider/service_account.go
new file mode 100644
index 0000000..495bc14
--- /dev/null
+++ b/internal/provider/service_account.go
@@ -0,0 +1,193 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+
+	client "github.com/pomerium/enterprise-client-go"
+	"github.com/pomerium/enterprise-client-go/pb"
+)
+
+var (
+	_ resource.Resource                = &ServiceAccountResource{}
+	_ resource.ResourceWithImportState = &ServiceAccountResource{}
+)
+
+func NewServiceAccountResource() resource.Resource {
+	return &ServiceAccountResource{}
+}
+
+type ServiceAccountResource struct {
+	client *client.Client
+}
+
+type ServiceAccountResourceModel = ServiceAccountModel
+
+func (r *ServiceAccountResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_service_account"
+}
+
+func (r *ServiceAccountResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "Service Account for Pomerium.",
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{
+				Computed:    true,
+				Description: "Unique identifier for the service account.",
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},
+			"name": schema.StringAttribute{
+				Description: "Name of the service account.",
+				Required:    true,
+			},
+			"namespace_id": schema.StringAttribute{
+				Description: "ID of the namespace the service account belongs to.",
+				Required:    true,
+			},
+			"description": schema.StringAttribute{
+				Description: "Description of the service account.",
+				Optional:    true,
+			},
+			"user_id": schema.StringAttribute{
+				Computed:    true,
+				Description: "User ID associated with the service account.",
+			},
+			"expires_at": schema.StringAttribute{
+				Computed:    true,
+				Description: "Timestamp when the service account expires.",
+			},
+		},
+	}
+}
+
+func (r *ServiceAccountResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	if req.ProviderData == nil {
+		return
+	}
+
+	c, ok := req.ProviderData.(*client.Client)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected Provider Data Type",
+			fmt.Sprintf("Expected *client.Client, got: %T.", req.ProviderData),
+		)
+		return
+	}
+
+	r.client = c
+}
+
+func (r *ServiceAccountResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan ServiceAccountResourceModel
+
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	pbServiceAccount, diags := ConvertServiceAccountToPB(ctx, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	respServiceAccount, err := r.client.PomeriumServiceAccountService.AddPomeriumServiceAccount(ctx, &pb.AddPomeriumServiceAccountRequest{
+		ServiceAccount: pbServiceAccount,
+	})
+	if err != nil {
+		resp.Diagnostics.AddError("Error creating service account", err.Error())
+		return
+	}
+
+	plan.ID = types.StringValue(respServiceAccount.ServiceAccount.Id)
+
+	tflog.Trace(ctx, "Created a service account", map[string]interface{}{
+		"id":   plan.ID.ValueString(),
+		"name": plan.Name.ValueString(),
+	})
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
+}
+
+func (r *ServiceAccountResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state ServiceAccountResourceModel
+
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	respServiceAccount, err := r.client.PomeriumServiceAccountService.GetPomeriumServiceAccount(ctx, &pb.GetPomeriumServiceAccountRequest{
+		Id: state.ID.ValueString(),
+	})
+	if err != nil {
+		resp.Diagnostics.AddError("Error reading service account", err.Error())
+		return
+	}
+
+	diags := ConvertServiceAccountFromPB(&state, respServiceAccount.ServiceAccount)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+}
+
+func (r *ServiceAccountResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan ServiceAccountResourceModel
+
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	pbServiceAccount, diags := ConvertServiceAccountToPB(ctx, &plan)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	_, err := r.client.PomeriumServiceAccountService.SetPomeriumServiceAccount(ctx, &pb.SetPomeriumServiceAccountRequest{
+		ServiceAccount: pbServiceAccount,
+	})
+	if err != nil {
+		resp.Diagnostics.AddError("Error updating service account", err.Error())
+		return
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
+}
+
+func (r *ServiceAccountResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state ServiceAccountResourceModel
+
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	_, err := r.client.PomeriumServiceAccountService.DeletePomeriumServiceAccount(ctx, &pb.DeletePomeriumServiceAccountRequest{
+		Id: state.ID.ValueString(),
+	})
+	if err != nil {
+		resp.Diagnostics.AddError("Error deleting service account", err.Error())
+		return
+	}
+
+	resp.State.RemoveResource(ctx)
+}
+
+func (r *ServiceAccountResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
+}
diff --git a/internal/provider/service_account_data_source.go b/internal/provider/service_account_data_source.go
new file mode 100644
index 0000000..05d112b
--- /dev/null
+++ b/internal/provider/service_account_data_source.go
@@ -0,0 +1,100 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+
+	client "github.com/pomerium/enterprise-client-go"
+	"github.com/pomerium/enterprise-client-go/pb"
+)
+
+var _ datasource.DataSource = &ServiceAccountDataSource{}
+
+func NewServiceAccountDataSource() datasource.DataSource {
+	return &ServiceAccountDataSource{}
+}
+
+type ServiceAccountDataSource struct {
+	client *client.Client
+}
+
+func (d *ServiceAccountDataSource) Metadata(_ context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_service_account"
+}
+
+func (d *ServiceAccountDataSource) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "Service Account for Pomerium.",
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{
+				Required:    true,
+				Description: "Unique identifier for the service account.",
+			},
+			"name": schema.StringAttribute{
+				Computed:    true,
+				Description: "Name of the service account.",
+			},
+			"namespace_id": schema.StringAttribute{
+				Computed:    true,
+				Description: "ID of the namespace the service account belongs to.",
+			},
+			"description": schema.StringAttribute{
+				Computed:    true,
+				Description: "Description of the service account.",
+			},
+			"user_id": schema.StringAttribute{
+				Computed:    true,
+				Description: "User ID associated with the service account.",
+			},
+			"expires_at": schema.StringAttribute{
+				Computed:    true,
+				Description: "Timestamp when the service account expires.",
+			},
+		},
+	}
+}
+
+func (d *ServiceAccountDataSource) Configure(_ context.Context, req datasource.ConfigureRequest, resp *datasource.ConfigureResponse) {
+	if req.ProviderData == nil {
+		return
+	}
+
+	client, ok := req.ProviderData.(*client.Client)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected Data Source Configure Type",
+			fmt.Sprintf("Expected *client.Client, got: %T.", req.ProviderData),
+		)
+		return
+	}
+
+	d.client = client
+}
+
+func (d *ServiceAccountDataSource) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
+	var data ServiceAccountModel
+
+	resp.Diagnostics.Append(req.Config.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	serviceAccountResp, err := d.client.PomeriumServiceAccountService.GetPomeriumServiceAccount(ctx, &pb.GetPomeriumServiceAccountRequest{
+		Id: data.ID.ValueString(),
+	})
+	if err != nil {
+		resp.Diagnostics.AddError("Error reading service account", err.Error())
+		return
+	}
+
+	diags := ConvertServiceAccountFromPB(&data, serviceAccountResp.ServiceAccount)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
diff --git a/internal/provider/service_accounts_data_source.go b/internal/provider/service_accounts_data_source.go
new file mode 100644
index 0000000..0e27a16
--- /dev/null
+++ b/internal/provider/service_accounts_data_source.go
@@ -0,0 +1,111 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+
+	client "github.com/pomerium/enterprise-client-go"
+	"github.com/pomerium/enterprise-client-go/pb"
+)
+
+var _ datasource.DataSource = &ServiceAccountsDataSource{}
+
+func NewServiceAccountsDataSource() datasource.DataSource {
+	return &ServiceAccountsDataSource{}
+}
+
+type ServiceAccountsDataSource struct {
+	client *client.Client
+}
+
+type ServiceAccountsDataSourceModel struct {
+	ServiceAccounts []ServiceAccountModel `tfsdk:"service_accounts"`
+}
+
+func (d *ServiceAccountsDataSource) Metadata(_ context.Context, req datasource.MetadataRequest, resp *datasource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_service_accounts"
+}
+
+func (d *ServiceAccountsDataSource) Schema(_ context.Context, _ datasource.SchemaRequest, resp *datasource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: "List all service accounts",
+
+		Attributes: map[string]schema.Attribute{
+			"service_accounts": schema.ListNestedAttribute{
+				Computed: true,
+				NestedObject: schema.NestedAttributeObject{
+					Attributes: map[string]schema.Attribute{
+						"id": schema.StringAttribute{
+							Computed:    true,
+							Description: "Unique identifier for the service account.",
+						},
+						"name": schema.StringAttribute{
+							Computed:    true,
+							Description: "Name of the service account.",
+						},
+						"namespace_id": schema.StringAttribute{
+							Computed:    true,
+							Description: "ID of the namespace the service account belongs to.",
+						},
+						"description": schema.StringAttribute{
+							Computed:    true,
+							Description: "Description of the service account.",
+						},
+						"user_id": schema.StringAttribute{
+							Computed:    true,
+							Description: "User ID associated with the service account.",
+						},
+						"expires_at": schema.StringAttribute{
+							Computed:    true,
+							Description: "Timestamp when the service account expires.",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func (d *ServiceAccountsDataSource) Configure(_ context.Context, req datasource.ConfigureRequest, resp *datasource.ConfigureResponse) {
+	if req.ProviderData == nil {
+		return
+	}
+
+	client, ok := req.ProviderData.(*client.Client)
+	if !ok {
+		resp.Diagnostics.AddError(
+			"Unexpected Data Source Configure Type",
+			fmt.Sprintf("Expected *client.Client, got: %T.", req.ProviderData),
+		)
+		return
+	}
+
+	d.client = client
+}
+
+func (d *ServiceAccountsDataSource) Read(ctx context.Context, _ datasource.ReadRequest, resp *datasource.ReadResponse) {
+	var data ServiceAccountsDataSourceModel
+
+	serviceAccountsResp, err := d.client.PomeriumServiceAccountService.ListPomeriumServiceAccounts(ctx, &pb.ListPomeriumServiceAccountsRequest{})
+	if err != nil {
+		resp.Diagnostics.AddError("Error reading service accounts", err.Error())
+		return
+	}
+
+	serviceAccounts := make([]ServiceAccountModel, 0, len(serviceAccountsResp.ServiceAccounts))
+	for _, sa := range serviceAccountsResp.ServiceAccounts {
+		var saModel ServiceAccountModel
+		diags := ConvertServiceAccountFromPB(&saModel, sa)
+		if diags.HasError() {
+			resp.Diagnostics.Append(diags...)
+			return
+		}
+		serviceAccounts = append(serviceAccounts, saModel)
+	}
+
+	data.ServiceAccounts = serviceAccounts
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}