Organizations

Lists change gates for an entity within the organization. Change gates define approval requirements that must be satisfied before changes can be applied to infrastructure resources. Currently supports listing gates for a single entity specified by entityType and qualifiedName query parameters.

Request Parameters

• orgName string path required
  The organization name
• entityType string query optional
  The entity type to filter by
• qualifiedName string query optional
  The fully qualified entity name

Responses

Creates a new change gate for an entity in the organization. Change gates enforce approval workflows by requiring one or more approvals before infrastructure changes can be applied to the protected resource.

Request Parameters

• orgName string path required
  The organization name

Request Body

• name string required
  Name of the change gate
• enabled boolean required
  Whether the change gate is enabled
• rule ChangeGateRuleInput required
  Rule configuration for the gate
• ↳ ruleType string required
• target ChangeGateTargetInput required
  Target configuration for the gate
• ↳ entityType enum required
  The entity type this gate targets
  Values: environment
• ↳ qualifiedName string optional
  The qualified name of the entity this gate targets (e.g., ‘project/env’)
• ↳ actionTypes array[string] required
  The action types this gate targets (currently only supports single action)

Responses

Retrieves the configuration and status of a specific change gate, including its approval requirements and the entity it protects.

Request Parameters

• orgName string path required
  The organization name
• gateID string path required
  The change gate identifier

Responses

Updates the configuration of an existing change gate, such as modifying its approval requirements or protected entity.

Request Parameters

• orgName string path required
  The organization name
• gateID string path required
  The change gate identifier

Request Body

• name string required
  Name of the change gate
• enabled boolean required
  Whether the change gate is enabled
• target ChangeGateTargetInput required
  Target configuration for the gate
• ↳ entityType enum required
  The entity type this gate targets
  Values: environment
• ↳ qualifiedName string optional
  The qualified name of the entity this gate targets (e.g., ‘project/env’)
• ↳ actionTypes array[string] required
  The action types this gate targets (currently only supports single action)
• rule ChangeGateRuleInput required
  Rule configuration for the gate
• ↳ ruleType string required

Responses

Deletes a change gate, removing the approval requirement from the protected entity. Changes to the entity will no longer require approval.

Request Parameters

• orgName string path required
  The organization name
• gateID string path required
  The change gate identifier

Responses

Lists change requests for an organization with support for pagination and filtering by entity type and entity ID. Change requests represent proposed infrastructure modifications that require approval before being applied.

Request Parameters

• orgName string path required
  The organization name
• continuationToken string query optional
  Continuation token for paginated results
• count integer query optional
  Number of items to return
• entityId string query optional
  The entity identifier to filter by
• entityType string query optional
  The entity type to filter by

Responses

Retrieves the details of a specific change request, including its current status, description, approvals, and the proposed infrastructure changes.

Request Parameters

• orgName string path required
  The organization name
• changeRequestID string path required
  The change request identifier

Responses

Updates a change request’s metadata. Currently only the description field can be modified after creation.

Request Parameters

• orgName string path required
  The organization name
• changeRequestID string path required
  The change request identifier

Request Body

• description string required
  Updated description/justification for the change request

Responses

Applies an approved change request, triggering the execution of the proposed infrastructure changes. The change request must have received the required number of approvals before it can be applied. Returns 409 if there is a conflict preventing application.

Request Parameters

• orgName string path required
  The organization name
• changeRequestID string path required
  The change request identifier

Responses

Records an approval for a change request from the authenticated user. Once the required number of approvals is met, the change request can be applied.

Request Parameters

• orgName string path required
  The organization name
• changeRequestID string path required
  The change request identifier

Request Body

• revisionNumber integer required
  Which revision to approve.
• comment string optional
  Optional note accompanying the approval

Responses

Withdraws a previously given approval for a change request. If the change request no longer has the required number of approvals after withdrawal, it cannot be applied until additional approvals are granted.

Request Parameters

• orgName string path required
  The organization name
• changeRequestID string path required
  The change request identifier

Request Body

• comment string optional
  Optional note clarifying the reason for revoking approval

Responses

Closes a change request without applying it. The proposed infrastructure changes are discarded and the request is marked as closed.

Request Parameters

• orgName string path required
  The organization name
• changeRequestID string path required
  The change request identifier

Request Body

• comment string optional
  Optional comment explaining why the change request is being closed

Responses

Adds a comment to a change request without approving or closing it. This allows reviewers to provide feedback or ask questions before making a decision.

Request Parameters

• orgName string path required
  The organization name
• changeRequestID string path required
  The change request identifier

Request Body

• comment string required
  The comment text to add to the change request.

Responses

Lists the event log for a change request, including approvals, status changes, and other lifecycle events. Supports pagination via continuation token.

Request Parameters

• orgName string path required
  The organization name
• changeRequestID string path required
  The change request identifier
• continuationToken string query optional
  Continuation token for paginated results

Responses

Submits a draft change request for approval. Once submitted, the request enters the review workflow and requires the configured number of approvals before it can be applied.

Request Parameters

• orgName string path required
  The organization name
• changeRequestID string path required
  The change request identifier

Request Body

• description string optional
  Description/justification for the change request

Responses

Returns detailed information about the specified organization, including its name, display name, avatar URL, enabled features, subscription tier, and access control settings. The response includes member count, team availability, and other configuration relevant to the caller’s role within the organization.

Request Parameters

• orgName string path required
  The organization name

Responses

Updates an organization’s settings, such as the default stack permission level for new members, whether members can create teams, and other organization-wide configuration options. Returns the updated organization metadata.

Request Parameters

• orgName string path required
  The organization name

Request Body

• setDefaultStackPermission enum optional
  The new default stack permission for the organization.
  Values: 0, 101, 102, 103, 104
• setDefaultEnvironmentPermission enum optional
  The new default environment permission for the organization.
  Values: none, read, open, write, admin
• setDefaultAccountPermission enum optional
  The new default account permission for the organization.
  Values: 0, 1, 2, 3
• setMembersCanCreateStacks boolean optional
  Whether members can create stacks.
• setMembersCanInviteCollaborators boolean optional
  Whether members can invite collaborators.
• setMembersCanDeleteStacks boolean optional
  Whether members can delete stacks.
• setMembersCanTransferStacks boolean optional
  Whether members can transfer stacks.
• setMembersCanCreateAccounts boolean optional
  Whether members can create accounts.
• setMembersCanCreateTeams boolean optional
  Whether members can create teams.
• setAiEnablement string optional
  The AI enablement setting for the organization.
• setNeoEnabled boolean optional
  Whether Neo is enabled for the organization.
• setNeoApprovalMode enum optional
  The default approval mode for Neo tasks.
  Values: manual, auto, balanced
• setNeoTaskSharingMode enum optional
  The task sharing mode for Neo.
  Values: none, org
• setPreferredVCS enum optional
  The preferred VCS provider for the organization.
  Values: none, bitbucket, github, gitlab
• setDefaultDeploymentRoleId string optional
  The ID of the default deployment role. When set, this role is applied to all deployments that do not have a role explicitly configured in their stack deployment settings. Set to an empty string to clear the default.
• setDefaultAgentPoolID string optional
  The ID of the default agent pool for the organization. Set to empty string to revert to the Pulumi Hosted Pool.

Responses

Updates an authentication policy for an organization. Authentication policies define rules for how OIDC tokens are validated and what access they grant, including claim mappings, trust conditions, and role assignments. The policy definition cannot be empty.

The request body contains a policies array where each policy object includes:

• decision: allow or deny
• tokenType: organization, team, personal, or runner
• teamName: required when tokenType is team
• userLogin: required when tokenType is personal
• runnerID: required when tokenType is runner
• authorizedPermissions: array of permissions (only admin is supported for organization tokens)
• rules: object defining claim-matching rules for the token

For more information about authorization rules, refer to the OIDC authorization policies documentation.

Request Parameters

• orgName string path required
  The organization name
• policyId string path required
  The policy identifier

Request Body

• policies array[AuthPolicyDefinition] required
  List of policies
• ↳ decision string required
  The access decision for matching tokens (e.g. ‘allow’, ‘deny’).
• ↳ tokenType string required
  The type of token this rule applies to (e.g. ‘personal’, ‘org’, ’team’).
• ↳ teamName string optional
  Team name filter. When set, this rule only applies to tokens belonging to this team.
• ↳ userLogin string optional
  User login filter. When set, this rule only applies to tokens belonging to this user.
• ↳ runnerID string optional
  Runner ID filter. When set, this rule only applies to tokens for this deployment runner.
• ↳ roleID string optional
  Role ID filter. When set, this rule only applies to tokens with this role.
• ↳ authorizedPermissions array[string] required
  The set of permissions granted when this rule matches.
• ↳ rules map[string]object required
  Additional rule conditions as key-value pairs.

Responses

TransferAllStacks transfers all active stacks from one org to another, where deleted stacks will be skipped/ignored. We are currently constraining usage of this function to organizations with less than or equal to TransferAllStacksMax stacks.

NOTE: This operation will lock the organization while the transfer is in-progress, to rewrite all checkpoint files that use service-managed secrets. This means that the organization will be read-only and no stack updates can begin until the rename process has completed.

Request Parameters

• orgName string path required
  The organization name

Request Body

• fromOrg string required
  The source organization to transfer stacks from. Must match the organization in the URL route.
• toOrg string required
  The destination organization to transfer stacks to.

Responses

Returns all customer managed keys (CMK) configured for an organization, including their key identifiers, cloud provider details, enabled status, and which key is set as the default for new stacks.

Request Parameters

• orgName string path required
  The organization name

Responses

Creates a new customer managed key (CMK) for an organization, allowing the organization to use their own encryption keys for securing secrets stored in Pulumi Cloud. The key must be a valid cloud provider key (e.g., AWS KMS). Once created, the key can be set as the default encryption key for all new stacks in the organization.

Request Parameters

• orgName string path required
  The organization name

Request Body

• name string required
  The name
• keyType enum required
  The key type
  Values: aws_kms, service
• awsKms AwsKmsConfig optional
  The aws kms
• ↳ roleArn string required
  ARN of the IAM role to assume for KMS operations.
• ↳ keyArn string required
  ARN of the KMS key to use for encrypting/decrypting secrets.

Responses

Sets a customer managed key as the default encryption key for the organization. New stacks created in the organization will use this key for encrypting secrets by default. The key must already be created and enabled for the organization.

Request Parameters

• orgName string path required
  The organization name
• keyID string path required
  The key identifier

Responses

Disables a specific customer managed key (CMK) for an organization. The key can no longer be used for encrypting new secrets, but existing secrets encrypted with this key remain accessible.

Request Parameters

• orgName string path required
  The organization name
• keyID string path required
  The key identifier

Request Body

• destID string required
  The destination identifier for the customer-managed key to disable.

Responses

Disables all customer managed keys (CMK) for an organization, reverting to Pulumi-managed encryption for secrets. After disabling, new stacks will use the default Pulumi-managed encryption rather than customer-provided keys.

Request Parameters

• orgName string path required
  The organization name

Responses

Returns all key encryption key (KEK) migrations for an organization. KEK migrations track the process of re-encrypting secrets when rotating customer managed keys. Each migration record includes the source and destination keys, status, and any errors encountered during the migration process.

Request Parameters

• orgName string path required
  The organization name

Responses

Retries any failed key encryption key (KEK) migrations for an organization. KEK migrations can fail due to transient errors when re-encrypting secrets during customer managed key rotation. This endpoint re-attempts the failed migrations without restarting the entire process.

Request Parameters

• orgName string path required
  The organization name

Responses

ListOrganizationMembers lists the members of an organization. This API unfortunately has two different “modes”, returning either the organization’s “frontend members” or “backend members”.

• A “frontend member” is data stored in the Pulumi Service’s database. For organizations billed per-member, this is the set of members that are counted against the organization’s seat cap.
• A “backend member” is data stored in the organization’s backend. (e.g. GitHub, GitLab, or for SAML orgs, also the Pulumi Service database.)

This isn’t ideal, but is required so that the APIs can be paginated correctly while not returning any users twice. (Which would be impossible in some cases.)

Request Parameters

• orgName string path required
  The organization name
• continuationToken string query optional
  Token for paginated result retrieval
• type string query optional
  Member type to list: ‘frontend’ for Pulumi Service members or ‘backend’ for organization backend members

Responses

Adds an existing Pulumi user to an organization with a built-in role. Important: The user must have already signed up for a Pulumi account before they can be added to an organization.

This endpoint only assigns built-in roles. To onboard a user with a custom role, use the organization invite flow (BatchCreateOrgInviteEmail) and set roleId on the invite — the custom role is applied when the user accepts. Alternatively, add the user here with a built-in role and then call UpdateOrganizationMember with fgaRoleId to reassign.

Returns the newly created organization member record. Returns 409 if the user is already a member of the organization.

Request Parameters

• orgName string path required
  The organization name
• userLogin string path required
  The user login name

Request Body

• role enum required
  The built-in role assigned to the new member. Must be member, admin, or billingManager.
  Values: none, member, admin, potential-member, stack-collaborator, billing-manager

Responses

Modifies a user’s role within an organization. Set role to assign a built-in role (member, admin, or billingManager), or set fgaRoleId to assign a custom role. If both are provided, fgaRoleId takes precedence.

Request Parameters

• orgName string path required
  The organization name
• userLogin string path required
  The user login name

Request Body

• role enum optional
  The built-in role to assign to the member. Must be member, admin, or billing-manager. Ignored if fgaRoleId is also set.
  Values: none, member, admin, potential-member, stack-collaborator, billing-manager
• fgaRoleId string optional
  The ID of a custom role to assign to the member. If both role and fgaRoleId are provided, fgaRoleId takes precedence.

Responses

Removes a user from an organization. The removed user loses access to all organization resources including stacks, teams, and projects. The caller cannot remove themselves from the organization. The user is also removed from all teams they belong to within the organization.

Request Parameters

• orgName string path required
  The organization name
• userLogin string path required
  The user login name

Responses

Promotes a member to administrator on organizations that are limited to a single admin. This endpoint is only valid for Team subscriptions (Team Starter and Team Growth) — it returns 400 on any other plan. On these plans, UpdateOrganizationMember cannot promote a member to admin, because doing so would require simultaneously demoting the current admin. This endpoint performs both changes atomically: the caller (who must be the current sole admin) is demoted to member and the target user is promoted to admin.

Note: This endpoint operates on built-in roles only and does not integrate with custom roles.

Request Parameters

• orgName string path required
  The organization name
• userLogin string path required
  The user login name

Responses

GetOrganizationMetadata returns metadata about the given organization. This is designed to be an inexpensive call.

Request Parameters

• orgName string path required
  The organization name

Responses

Returns the stacks within an organization that use a specific Pulumi package, helping track package adoption and identify affected stacks when planning package upgrades or deprecations.

Request Parameters

• orgName string path required
  The organization name
• continuationToken string query optional
  The continuation token
• limit integer query optional
  Maximum number of results to return per page. Defaults to 100, maximum 500.
• packageName string query optional
  The package name
• version string query optional
  Filter to stacks using this specific version. If omitted, returns stacks using any version.

Responses

ListDeletedStacks returns the last 25 deleted stacks for a given org. It would be incredible to one day merge this function with ListOrganizationProjects – but that function is very bloated and not performant, so implementing a lighter-weight handler focusing only on the most recently deleted stacks.

Request Parameters

• orgName string path required
  The organization name

Responses

RestoreDeletedStack un-deletes a soft-deleted stack for the given programID if the organization has the restore stacks feature enabled.

Request Parameters

• orgName string path required
  The organization name
• programID string path required
  The program identifier

Request Body

• stackName string required
  The name of the stack to restore.

Responses

Returns custom roles for an organization filtered by their UX purpose (e.g., ‘organization’, ’team’, or ’token’). This allows the UI to display only the roles relevant to the current context, such as showing only organization-level roles when managing member access.

Request Parameters

• orgName string path required
  The organization name
• uxPurpose string query optional
  Filter roles by their UX purpose (e.g., ‘organization’, ’team’, ’token’)

Responses

Creates a new custom role for an organization. Custom roles define fine-grained permission sets that can be assigned to organization members and teams, enabling precise access control beyond the built-in admin and member roles. Optionally, an associated policy and role binding can be created alongside the role.

Request Parameters

• orgName string path required
  The organization name
• createPolicyAndRole boolean query optional
  Also create an associated policy and role binding alongside the role

Request Body

• name string optional
  The name of the permission descriptor.
• description string optional
  A human-readable description of the permission descriptor.
• resourceType string optional
  The resource type this permission descriptor applies to.
• uxPurpose enum optional
  The UX purpose of this permission descriptor (e.g. role, policy, set).
  Values: role, role_private, role_temporary, policy, set
• details PermissionDescriptor optional
  The detailed permission descriptor tree.
• ↳ __type string required

Responses

Returns the details of a specific custom role, including its name, description, and the set of permission scopes it grants. Custom roles enable fine-grained access control beyond the built-in admin and member roles.

Request Parameters

• orgName string path required
  The organization name
• roleID string path required
  The role identifier

Responses

Updates an existing custom role’s name, description, or permission scopes. Changes take effect immediately for all members and teams assigned to the role.

Request Parameters

• orgName string path required
  The organization name
• roleID string path required
  The role identifier

Request Body

• Name string required
  The new name for the role.
• Description string required
  The new description for the role.
• Details PermissionDescriptor required
  The permission details for the role.
• ↳ __type string required

Responses

Deletes a custom role from an organization. If the role is currently assigned to members or teams, deletion requires the force parameter. Deleting a role revokes the permissions it granted to any assigned members or teams.

Request Parameters

• orgName string path required
  The organization name
• roleID string path required
  The role identifier
• force boolean query optional
  Force deletion even if the role is currently assigned to members or teams

Responses

Sets the default custom role for the organization. New members who join the organization will be automatically assigned this role unless a different role is specified during the invitation process.

Request Parameters

• orgName string path required
  The organization name
• roleID string path required
  The role identifier

Responses

Request Parameters

• orgName string path required
  The organization name
• roleID string path required
  The role identifier

Responses

Returns all organization tokens that have been assigned to a specific custom role. This helps administrators audit which tokens have particular permission levels and manage token-to-role assignments for least-privilege access.

Request Parameters

• orgName string path required
  The organization name
• roleID string path required
  The role identifier

Responses

Request Parameters

• orgName string path required
  The organization name
• roleID string path required
  The role identifier

Responses

Returns all available permission scopes that can be assigned to custom roles, organized by category (e.g., stacks, teams, organization settings). Each scope represents a specific action or capability that can be granted or denied.

Request Parameters

• orgName string path required
  The organization name

Responses

Returns the SAML configuration data for an organization, including the SSO endpoint URL, identity provider metadata, and SAML attribute mappings. SAML-backed organizations use an external identity provider for user authentication and can enforce single sign-on for all members.

Request Parameters

• orgName string path required
  The organization name

Responses

Updates the SAML configuration for a SAML-backed organization, including the identity provider SSO descriptor, attribute mappings, and other SAML settings. The new IDP SSO descriptor is required in the update request.

Request Parameters

• orgName string path required
  The organization name

Request Body

• newIdpSsoDescriptor string optional
  The new IDP SSO descriptor XML for the SAML configuration.

Responses

ListSAMLOrganizationAdmins returns the list of SAML admins for an organization. We currently only support one SAML admin per organization, where the SAML admin is the user who onboarded the organization to SAML.

Request Parameters

• orgName string path required
  The organization name

Responses

Updates the SAML admin for an organization. The SAML admin is the user who manages the SAML SSO configuration. Currently, each organization supports only one SAML admin (typically the user who onboarded the organization to SAML). The new admin must not belong to other organizations.

Request Parameters

• orgName string path required
  The organization name
• userLogin string path required
  The user login name

Responses

Returns a 200 response if the search cluster is available and healthy, 404 otherwise. This is a lightweight health check used to determine whether resource search functionality is operational for the organization.

Request Parameters

• orgName string path required
  The organization name

Responses

Returns aggregation results for a given field in resource search, providing the unique values and counts for a specific field like ’type’, ‘package’, or ‘project’. This is used to populate filter dropdowns and faceted navigation in the resource search UI.

Request Parameters

• orgName string path required
  The organization name
• field string query optional
  The resource field to aggregate (e.g., ’type’, ‘package’, ‘project’)
• query string query optional
  Search query string

Responses

GetUsageSummaryEnvironmentSecrets handles request to fetch the summary of ESC secret hours for an organization.

Request Parameters

• orgName string path required
  The organization name
• granularity string query optional
  Time granularity for aggregation (e.g., ‘hourly’, ‘daily’, ‘monthly’)
• lookbackDays integer query optional
  Number of days to look back from the current time or lookbackStart
• lookbackStart integer query optional
  Unix timestamp for the start of the lookback period (defaults to current time if omitted)

Responses

Retrieves all teams within an organization. Teams provide a centralized way to manage stack access permissions for groups of users. The response includes each team’s name, type (Pulumi-managed, GitHub-backed, or GitLab-backed), member count, and summary of stack permissions. Teams are available to organizations on Enterprise and Business Critical editions.

Request Parameters

• orgName string path required
  The organization name

Responses

Retrieves detailed information about a specific team within an organization. The response includes the team name, display name, description, team type (Pulumi-managed, GitHub-backed, or GitLab-backed), list of members with their roles (team admin or team member), and the stack permissions granted to the team. Teams provide a centralized way to manage stack access for groups of users.

Request Parameters

• orgName string path required
  The organization name
• teamName string path required
  The team name

Responses

Updates a team’s membership and configuration. This multi-purpose endpoint supports several operations:

Update membership: Use member (username) and memberAction (add or remove) to manage team members.

Grant stack access: Use addStackPermission with projectName, stackName, and permission (integer: 101 = read, 102 = edit, 103 = admin).

Remove stack access: Use removeStack with projectName and stackName.

Members added to a team inherit the team’s stack permissions. Teams are not available to individual (single-user) organizations.

Request Parameters

• orgName string path required
  The organization name
• teamName string path required
  The team name

Request Body

• newDisplayName string optional
  The new display name for the team.
• newDescription string optional
  The new description for the team.
• memberAction enum optional
  MemberAction is the action to perform.
  Values: add, remove, promote, demote
• member string optional
  Member to be added or removed based on MemberAction.
• addStackPermission TeamStackPermission optional
  A stack permission to add to the team.
• ↳ projectName string required
  The project containing the stack.
• ↳ stackName string required
  The stack within the project.
• ↳ permission enum required
  The permission level the team has on this stack (e.g., read, write, admin).
  Values: 0, 101, 102, 103, 104
• ↳ permissionSetName string optional
  Display name of the permission set for this stack, when available. Enables read-only entity access UI without requiring RoleRead.
• editStackPermission TeamStackPermission optional
  A stack permission to edit on the team.
• ↳ projectName string required
  The project containing the stack.
• ↳ stackName string required
  The stack within the project.
• ↳ permission enum required
  The permission level the team has on this stack (e.g., read, write, admin).
  Values: 0, 101, 102, 103, 104
• ↳ permissionSetName string optional
  Display name of the permission set for this stack, when available. Enables read-only entity access UI without requiring RoleRead.
• removeStack RemoveStackIdentifier optional
  A stack to remove from the team.
• ↳ projectName string required
  The name of the project containing the stack.
• ↳ stackName string required
  The name of the stack to remove.
• addEnvironmentPermission TeamEnvironmentSettings optional
  An environment permission to add to the team.
• ↳ projectName string required
  The project containing the environment.
• ↳ envName string required
  The environment within the project.
• ↳ permission enum required
  The permission level the team has on this environment.
  Values: none, read, open, write, admin
• ↳ maxOpenDuration string optional
  The maximum duration an environment session can remain open, as a Go duration string (e.g. “1h30m”).
• ↳ permissionSetName string optional
  Display name of the permission set for this environment, when available. Enables read-only entity access UI without requiring RoleRead.
• editEnvironmentPermission TeamEnvironmentSettings optional
  An environment permission to edit on the team.
• ↳ projectName string required
  The project containing the environment.
• ↳ envName string required
  The environment within the project.
• ↳ permission enum required
  The permission level the team has on this environment.
  Values: none, read, open, write, admin
• ↳ maxOpenDuration string optional
  The maximum duration an environment session can remain open, as a Go duration string (e.g. “1h30m”).
• ↳ permissionSetName string optional
  Display name of the permission set for this environment, when available. Enables read-only entity access UI without requiring RoleRead.
• removeEnvironment RemoveEnvironmentIdentifier optional
  An environment to remove from the team.
• ↳ projectName string required
  The name of the project containing the environment.
• ↳ envName string required
  The name of the environment to remove.

Responses

Permanently removes a team from an organization. All stack permission grants assigned to the team are revoked, and team members lose any access that was granted solely through team membership. Team tokens associated with the team are also invalidated. This action cannot be undone.

Request Parameters

• orgName string path required
  The organization name
• teamName string path required
  The team name

Responses

Enables custom role-based access control for a team. Once enabled, the team can be assigned custom roles that define fine-grained permissions beyond the default team admin and team member roles. Returns the created role descriptor.

Request Parameters

• orgName string path required
  The organization name
• teamName string path required
  The team name

Responses

ListTeamRoles will list the roles for a team. For now, this will always be a list of one, since we currently only support one role per team.

Request Parameters

• orgName string path required
  The organization name
• teamName string path required
  The team name

Responses

UpdateTeamRoles upserts the role assigned to a team since we currently only support a 1:1 mapping of teams to roles.

Request Parameters

• orgName string path required
  The organization name
• teamName string path required
  The team name
• roleID string path required
  The role identifier

Responses

Removes a custom role assignment from a team. This revokes the permissions that were granted to team members through the role. Currently only one role can be assigned per team.

Request Parameters

• orgName string path required
  The organization name
• teamName string path required
  The team name
• roleID string path required
  The role identifier

Responses

Retrieves all access tokens for a specific team. Team tokens inherit the stack permissions assigned to the team, providing scoped CI/CD automation access. The response includes token metadata such as name, description, creation date, last used date, and expiration status. The actual token values are never returned after initial creation. An optional filter parameter can include expired tokens.

Request Parameters

• orgName string path required
  The organization name
• teamName string path required
  The team name
• filter string query optional
  Filter tokens by status (e.g., include expired tokens)

Responses

Generates a new access token scoped to a specific team within an organization. Team tokens inherit the stack permissions assigned to the team, making them suitable for CI/CD pipelines that need access limited to a specific set of stacks.

The name field must be unique across the organization (including deleted tokens) and cannot exceed 40 characters. The expires field accepts a unix epoch timestamp up to two years from the present, or 0 for no expiry (default).

Important: The token value in the response is only returned once at creation time and cannot be retrieved later.

Request Parameters

• orgName string path required
  The organization name
• teamName string path required
  The team name
• reason string query optional
  Audit log reason for creating this token

Request Body

• description string required
  The description
• name string required
  The name
• expires integer required
  The expiration time

Responses

Permanently revokes and deletes a team access token. Any CI/CD pipelines or automation using this token will immediately lose access to the stacks assigned to the team. This action cannot be undone.

Request Parameters

• orgName string path required
  The organization name
• teamName string path required
  The team name
• tokenId string path required
  The access token identifier
• reason string query optional
  Audit log reason for deleting this token

Responses

Creates a new Pulumi team backed by a GitHub team. When an organization is backed by GitHub, existing GitHub teams can be imported into Pulumi to manage stack permissions. Membership is managed through GitHub while stack access permissions are controlled within Pulumi Cloud. The request must include the GitHub team ID. Returns 409 if a team with the same name already exists.

Request Parameters

• orgName string path required
  The organization name

Request Body

• githubTeamID integer required
  GitHubTeamID is the GitHub ID of the team to mirror. Must be in the same GitHub organization that the Pulumi org is backed by.

Responses

CreatePulumiTeam creates a “Pulumi” team, i.e. one whose membership is managed by Pulumi. (As opposed to a GitHub or GitLab-based team.)

Request Parameters

• orgName string path required
  The organization name

Request Body

• name string required
  The name
• displayName string required
  The display name
• description string required
  The description

Responses

GetProjectTemplate attempts to fetch Pulumi.yaml from a template repository. If the repository represents a valid template, we return a response identical to the format we use for the public pulumi/templates repo.

This API accepts either a url or project query param to denote either where to fetch the project template from or which project’s pre-configured template to use respectively. If both are passed in project take precedence, falling back to url if there is no source configured on the project.

Request Parameters

• orgName string path required
  The organization name

Responses

GetProjectTemplateConfiguration attempts to lookup any config we store for the template using the template query parameter passed in as a key into the org’s template sources.

Request Parameters

• orgName string path required
  The organization name

Responses

Downloads a template archive for an organization as an application/x-tar binary stream. The template is identified by a URL query parameter pointing to the template source. Returns the tar archive containing the template’s project files and configuration.

Request Parameters

• orgName string path required
  The organization name

Responses

Returns the README content for an organization template as Markdown text. The template is identified by a URL query parameter. Returns 404 if the template does not contain a README.md file, or 422 if the README content is invalid.

Request Parameters

• orgName string path required
  The organization name

Responses

Returns a combined list of all templates available to the organization and the current user. This includes templates from the organization’s configured template collections as well as Pulumi’s built-in public templates. Each template includes its name, description, language, and source URL.

Request Parameters

• orgName string path required
  The organization name

Responses

Returns all template collections (sources) configured for an organization. Template collections define where project templates are sourced from, such as Git repositories. Each collection includes its name, URL, and the templates it provides.

Request Parameters

• orgName string path required
  The organization name

Responses

Creates a new template collection (source) for an organization. Template collections define where project templates are sourced from, such as a Git repository. Organization members can use these templates to create new stacks with pre-configured infrastructure code.

Request Parameters

• orgName string path required
  The organization name

Request Body

• name string required
  The name of the template source.
• sourceURL string required
  The source URL to fetch templates from.
• destinationURL string optional
  The destination URL for the template source.
• destination TemplateDestination optional
  deprecated - use DestinationURL instead
• ↳ url string required
  The destination URL.

Responses