Stacks

Lists all permissions granted to a specific organization member for a given stack. The response provides a comprehensive view of the user’s access, including permissions inherited from the organization’s default role, permissions granted through team memberships, and permissions explicitly assigned to the user. Returns 404 if the user does not exist.

Request Parameters

• orgName string path required
  The organization name
• userLogin string path required
  The user login
• projectName string path required
  The project name
• stackName string path required
  The stack name

Responses

Returns aggregated stack overview data optimized for display in the Pulumi Cloud web console. The response combines information from multiple sources including the stack’s current state, recent activity, resource counts, and configuration into a single response to minimize round trips.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Responses

Modifies the permissions that a specific team has for the referenced stack. This allows setting the team’s permission level (read, write, admin) for a single stack without affecting the team’s permissions on other stacks. Returns 400 if the permission level is invalid or the team does not have the required base permissions. Returns 403 if the caller lacks permission to update the team. Returns 404 if the team does not exist.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• teamName string path required
  The team name

Request Body

• permissions enum optional
  Permissions the permissions that team membership grants to the stack. Will overwrite any existing permissions the team grants to the stack. A nil value will remove the stack from the team.
  Values: 0, 101, 102, 103, 104

Responses

Returns a human-readable summary of a specific update, identified by its update ID. The summary is formatted in the same manner as generated by the CLI on ‘pulumi up’, including a tree view of resource changes, create/update/delete counts, and the overall result. This endpoint is optimized for display in the Pulumi Cloud web console. Returns 404 if the update does not exist.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Responses

Returns a human-readable summary of the most recent update to the stack, without requiring a specific update ID. The summary is formatted identically to the UpdateSummary endpoint, including a tree view of resource changes. This is a convenience endpoint that automatically resolves the latest update version. Returns 404 if the stack has no updates.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Responses

Retrieves detailed information about a specific stack, including its organization, project, and stack name, the current version number, all associated tags, any active update operations (with the operation kind, author, and start time), and the active update UUID. This is the primary endpoint for inspecting the current state and metadata of a stack.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Responses

Removes a stack from Pulumi Cloud. By default, the stack must have no resources remaining; attempting to delete a stack that still manages resources will fail. Use the ‘force’ query parameter set to true to override this check and force deletion even when resources remain. The deletion is a soft-delete that hides the stack from normal queries. Returns 204 with no content on success.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• force boolean query optional
  When true, forces deletion even if the stack still has resources

Responses

Returns the activity history for a stack, including updates, configuration changes, and other operations. Supports pagination via page and pageSize parameters (page 0 returns all results). Returns 400 if the page parameter is invalid.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• page integer query optional
  Page number for paginated results (0-indexed, where 0 returns all results)
• pageSize integer query optional
  Number of results per page (must be >= 1 when page > 0)

Responses

Retrieves an annotation for a stack, identified by the annotation kind. Annotations are structured metadata that can be attached to stacks for purposes such as compliance tracking, custom metadata, or integration data. The optional ‘source’ and ‘version’ query parameters allow filtering by annotation source and specific version. Returns 404 if the annotation does not exist.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• kind string path required
  The annotation kind
• source string query optional
  The annotation source
• version integer query optional
  The annotation version number, used for filtering by a specific version

Responses

Creates or updates an annotation for a stack, identified by the annotation kind. Annotations are structured metadata that can be attached to stacks. The ‘version’ query parameter supports optimistic concurrency control: if provided, the update only succeeds if the current annotation version matches. Returns 409 if the annotation has changed since it was read (version conflict).

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• kind string path required
  The annotation kind
• source string query optional
  The annotation source
• version integer query optional
  The expected annotation version for optimistic concurrency control

Request Body

Responses

Decrypts a set of secret values in a single request using the stack’s encryption key. The request body contains an array of base64-encoded ciphertexts. The response maps each ciphertext to its decrypted plaintext value. This is a more efficient alternative to calling the single-value decrypt endpoint multiple times. Returns 400 if the request body is invalid or if message authentication fails. Returns 413 if the request body exceeds the maximum allowed content size.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• ciphertexts array[array] required
  List of ciphertexts

Responses

Encrypts a set of plaintext values in a single request using the stack’s encryption key. This is a more efficient alternative to calling the single-value encrypt endpoint multiple times. The response contains a map of the original plaintext values to their corresponding base64-encoded ciphertexts. Returns 413 if the request body exceeds the maximum allowed content size.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• plaintexts array[array] required
  The values to encrypt.

Responses

Lists all collaborators for a stack, including their permission levels. This includes collaborators who have been invited but have not yet accepted their invitations. The response includes each collaborator’s username and their permission level for the stack. This endpoint is deprecated.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Responses

Removes a specific user’s direct permission to access a stack. This only removes permissions explicitly granted to the user; permissions inherited from team membership or organization-level defaults are not affected. Returns 404 if the user does not exist.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• userName string path required
  The user name

Responses

Decrypts a single secret value using the stack’s encryption key. The request body contains the base64-encoded ciphertext. The response contains the decrypted plaintext value. For decrypting multiple values in a single request, use the BatchDecryptValue endpoint instead. Returns 413 if the request body exceeds the maximum allowed content size.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• ciphertext array[string] required
  The value to decrypt.

Responses

Records an audit log entry for a batch decryption event performed by a third-party secrets provider. When stacks use external secrets providers (such as AWS KMS, Azure Key Vault, or HashiCorp Vault), decryption happens client-side; this endpoint allows the CLI to report that decryption occurred for audit tracking purposes.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• secretName string optional
  The secret name
• commandName string optional
  The command name

Responses

Records an audit log entry for a single-value decryption event performed by a third-party secrets provider. When stacks use external secrets providers (such as AWS KMS, Azure Key Vault, or HashiCorp Vault), decryption happens client-side; this endpoint allows the CLI to report that decryption occurred for audit tracking.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• secretName string optional
  The secret name
• commandName string optional
  The command name

Responses

Creates a new destroy update for the given stack. A destroy update tears down all resources managed by the stack. This only creates the update record; the update must subsequently be started via the StartUpdateForDestroy endpoint. Enforces stack update concurrency checks to prevent conflicting simultaneous operations.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• name string required
  Properties from the Project file. Subset of pack.Package.
• runtime string required
  The runtime
• main string required
  The main entry point
• description string required
  The description
• options AppUpdateOptions required
  The options
• ↳ localPolicyPackPaths array[string] required
  File system paths to local policy packs to apply during this update.
• ↳ color string required
  Terminal color mode for output rendering (e.g. ‘always’, ’never’, ‘auto’).
• ↳ dryRun boolean required
  If true, perform a preview without actually applying changes.
• ↳ parallel integer required
  Maximum number of resource operations to perform in parallel. 0 or -1 for unlimited.
• ↳ showConfig boolean required
  If true, include configuration values in the update output.
• ↳ showReplacementSteps boolean required
  If true, include detailed replacement steps in the update output.
• ↳ showNames boolean required
  If true, include unchanged resources in the update output.
• ↳ summary boolean required
  If true, only show a summary of changes rather than full details.
• ↳ debug boolean required
  If true, enable verbose debug logging during the update.
• config map[string]AppConfigValue required
  Configuration values.
• metadata AppUpdateMetadata required
  The metadata
• ↳ message string required
  Message is an optional message associated with the update.
• ↳ environment map[string]string required
  Environment contains optional data from the deploying environment. e.g. the current source code control commit information.

Responses

Returns the current status and results of a destroy update, including whether it is still in progress, succeeded, or failed. Supports pagination of results via the continuationToken query parameter.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID
• continuationToken string query optional
  Continuation token for paginated results

Responses

Starts execution of a previously created destroy update. The update must have been created via CreateUpdateForDestroy first. Returns a lease token and version number for tracking the update. Returns 404 if the update does not exist, or 409 if another update is already in progress on the stack.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• tags map[string]string optional
  Tags contains an updated set of Tags for the stack. If non-nil, will replace the current set of tags associated with the stack.
• journalVersion integer optional
  JournalVersion indicates the maximum journal version the client supports. If 0, journaling is not supported.

Responses

Requests cancellation of a service-managed update that is currently in progress. The update must have been started (returns 409 if it has not). Returns 404 if the specified update does not exist. The cancellation is processed asynchronously and the update will transition to a cancelled state.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Responses

Uploads a new checkpoint (deployment state snapshot) for a service-managed update that is currently in progress. The checkpoint contains the complete current state of all resources. The request must contain a valid checkpoint object. Returns 403 for preview operations since previews do not modify actual state. Returns 409 if the update has not started, has been cancelled, timed out, or already completed. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• isInvalid boolean required
  Whether invalid
• version integer required
  The version number
• features array[string] optional
  The features
• deployment object optional
  The deployment data

Responses

Uploads a checkpoint delta for a service-managed update that is currently in progress. Rather than uploading the complete checkpoint state, this endpoint accepts an incremental delta that is applied to the existing checkpoint, reducing the payload size. The delta is persisted in the format as provided. Supports checksum validation for data integrity. Returns 403 for preview operations since previews do not modify actual state. Returns 409 if the update has not started, has been cancelled, timed out, or already completed. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• version integer required
  Protocol version.
• checkpointHash string required
  SHA256 hash of the result of aplying the DeploymentDelta to the previously saved deployment.
• sequenceNumber integer required
  Idempotency key incremented by the client on every PATCH call within the same update.
• deploymentDelta object optional
  Textual diff that recovers the desired deployment JSON when applied to the previously saved deployment JSON.

Responses

Uploads a checkpoint for a service-managed update as a verbatim byte array, bypassing JSON marshalling. Unlike PatchUpdateCheckpoint which accepts a structured deployment object and re-serializes it (which may compact data), this endpoint preserves the exact bytes provided by the client and uploads them directly to blob storage. This maintains byte-level fidelity of the checkpoint data. Returns 403 for preview operations. Returns 409 if the update has not started, has been cancelled, timed out, or already completed. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• version integer required
  The version number
• untypedDeployment object optional
  The untyped deployment
• sequenceNumber integer required
  Idempotency key incremented by the client on every PATCH call within the same update.

Responses

Marks a service-managed update as complete. The request body must include the final status of the update. Returns 400 if the status is unrecognized. Returns 409 if the update has not started, has been cancelled, has already timed out, or has already completed. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• status enum required
  The current status
  Values: not started, requested, running, failed, succeeded, cancelled

Responses

Records a single engine event sent from the Pulumi CLI during a stack update. Engine events represent individual resource operations or diagnostic messages. For better performance, consider using RecordEngineEventBatch to send multiple events in a single request. Returns 400 if no event data is provided, or 404 if the update does not exist. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• sequence integer required

  Sequence is a unique, and monotonically increasing number for each engine event sent to the Pulumi Service. Since events may be sent concurrently, and/or delayed via network routing, the sequence number is to ensure events can be placed into a total ordering.

  • No two events can have the same sequence number.
  • Events with a lower sequence number must have been emitted before those with a higher sequence number.
• timestamp integer required
  Timestamp is a Unix timestamp (seconds) of when the event was emitted.
• cancelEvent AppCancelEvent optional
  The cancel event
• stdoutEvent AppStdoutEngineEvent optional
  The stdout event
• ↳ message string required
  The message content
• ↳ color string required
  The output color
• diagnosticEvent AppDiagnosticEvent optional
  The diagnostic event
• ↳ urn string optional
  The Pulumi URN
• ↳ prefix string optional
  The prefix
• ↳ message string required
  The message content
• ↳ color string required
  The output color
• ↳ severity string required
  Severity is one of “info”, “info#err”, “warning”, or “error”.
• ↳ streamID integer optional
  The stream identifier
• ↳ ephemeral boolean optional
  Whether ephemeral is enabled
• preludeEvent AppPreludeEvent optional
  The prelude event
• ↳ config map[string]string required
  Config contains the keys and values for the update. Encrypted configuration values may be blinded.
• summaryEvent AppSummaryEvent optional
  The summary event
• ↳ maybeCorrupt boolean required
  MaybeCorrupt is set if one or more of the resources is in an invalid state.
• ↳ durationSeconds integer required
  Duration is the number of seconds the update was executing.
• ↳ resourceChanges map[string]integer required
  ResourceChanges contains the count for resource change by type.
• ↳ PolicyPacks map[string]string required
  Policy Packs run during the update, as a map from policy pack name to version. For newer clients, the value is the version tag prefixed with v; for older clients it is the raw version.
• ↳ isPreview boolean required
  IsPreview indicates whether this is a preview or an update.
• resourcePreEvent AppResourcePreEvent optional
  The resource pre event
• ↳ metadata AppStepEventMetadata required
  The metadata
• ↳ planning boolean optional
  Whether planning is enabled
• resOutputsEvent AppResOutputsEvent optional
  The res outputs event
• ↳ metadata AppStepEventMetadata required
  The metadata
• ↳ planning boolean optional
  Whether planning is enabled
• resOpFailedEvent AppResOpFailedEvent optional
  The res op failed event
• ↳ metadata AppStepEventMetadata required
  The metadata
• ↳ status integer required
  The current status
• ↳ steps integer required
  The steps
• policyEvent AppPolicyEvent optional
  The policy event
• ↳ resourceUrn string optional
  The resource urn
• ↳ message string required
  The message content
• ↳ color string required
  The output color
• ↳ policyName string required
  The policy name
• ↳ policyPackName string required
  The policy pack name
• ↳ policyPackVersion string required
  The policy pack version
• ↳ policyPackVersionTag string required
  The policy pack version tag
• ↳ enforcementLevel string required
  EnforcementLevel is one of “warning”, “mandatory”, “remediate”, or “none”.
• ↳ severity string optional
  Severity is one of “low”, “medium”, “high”, or “critical”. An empty string is omitted and represents an unspecified severity.
• policyRemediationEvent AppPolicyRemediationEvent optional
  The policy remediation event
• ↳ resourceUrn string optional
  The resource urn
• ↳ color string required
  The output color
• ↳ policyName string required
  The policy name
• ↳ policyPackName string required
  The policy pack name
• ↳ policyPackVersion string required
  The policy pack version
• ↳ policyPackVersionTag string required
  The policy pack version tag
• ↳ before map[string]object optional
  Map of before
• ↳ after map[string]object optional
  Map of after
• policyLoadEvent AppPolicyLoadEvent optional
  The policy load event
• policyAnalyzeSummaryEvent AppPolicyAnalyzeSummaryEvent optional
  The policy analyze summary event
• ↳ resourceUrn string required
  The URN of the resource being analyzed.
• ↳ policyPackName string required
  The name of the policy pack.
• ↳ policyPackVersion string required
  The version of the policy pack.
• ↳ policyPackVersionTag string required
  The version tag of the policy pack.
• ↳ passed array[string] optional
  The names of resource policies that passed (i.e. did not produce any violations).
• ↳ failed array[string] optional
  The names of resource policies that failed (i.e. produced violations).
• policyRemediateSummaryEvent AppPolicyRemediateSummaryEvent optional
  The policy remediate summary event
• ↳ resourceUrn string required
  The URN of the resource being remediated.
• ↳ policyPackName string required
  The name of the policy pack.
• ↳ policyPackVersion string required
  The version of the policy pack.
• ↳ policyPackVersionTag string required
  The version tag of the policy pack.
• ↳ passed array[string] optional
  The names of resource policies that passed (i.e. did not produce any violations).
• ↳ failed array[string] optional
  The names of resource policies that failed (i.e. produced violations).
• policyAnalyzeStackSummaryEvent AppPolicyAnalyzeStackSummaryEvent optional
  The policy analyze stack summary event
• ↳ policyPackName string required
  The name of the policy pack.
• ↳ policyPackVersion string required
  The version of the policy pack.
• ↳ policyPackVersionTag string required
  The version tag of the policy pack.
• ↳ passed array[string] optional
  The names of stack policies that passed (i.e. did not produce any violations).
• ↳ failed array[string] optional
  The names of stack policies that failed (i.e. produced violations).
• startDebuggingEvent AppStartDebuggingEvent optional
  The start debugging event
• ↳ config map[string]object optional
  The configuration
• progressEvent AppProgressEvent optional
  The progress event
• ↳ type enum required
  The type of process (e.g. plugin download, plugin install).
  Values: plugin-download, plugin-install
• ↳ id string required
  A unique identifier for the process.
• ↳ message string required
  A message accompanying the process.
• ↳ received integer required
  The number of items completed so far (e.g. bytes received, items installed, etc.)
• ↳ total integer required
  The total number of items that must be completed.
• ↳ done boolean required
  True if and only if the process has completed.
• errorEvent AppErrorEvent optional
  The error event
• ↳ error string required
  Error is the error message.

Responses

Records a batch of engine events sent from the Pulumi CLI during a stack update. Engine events represent individual resource operations (create, update, delete, etc.) and diagnostic messages. Batching events reduces the number of API calls during an update. Returns 400 if no events are provided in the batch, or 404 if the update does not exist. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• events array[AppEngineEvent] required
  List of events
• ↳ sequence integer required

  Sequence is a unique, and monotonically increasing number for each engine event sent to the Pulumi Service. Since events may be sent concurrently, and/or delayed via network routing, the sequence number is to ensure events can be placed into a total ordering.

  • No two events can have the same sequence number.
  • Events with a lower sequence number must have been emitted before those with a higher sequence number.
• ↳ timestamp integer required
  Timestamp is a Unix timestamp (seconds) of when the event was emitted.
• ↳ cancelEvent AppCancelEvent optional
  The cancel event
• ↳ stdoutEvent AppStdoutEngineEvent optional
  The stdout event
• ↳ diagnosticEvent AppDiagnosticEvent optional
  The diagnostic event
• ↳ preludeEvent AppPreludeEvent optional
  The prelude event
• ↳ summaryEvent AppSummaryEvent optional
  The summary event
• ↳ resourcePreEvent AppResourcePreEvent optional
  The resource pre event
• ↳ resOutputsEvent AppResOutputsEvent optional
  The res outputs event
• ↳ resOpFailedEvent AppResOpFailedEvent optional
  The res op failed event
• ↳ policyEvent AppPolicyEvent optional
  The policy event
• ↳ policyRemediationEvent AppPolicyRemediationEvent optional
  The policy remediation event
• ↳ policyLoadEvent AppPolicyLoadEvent optional
  The policy load event
• ↳ policyAnalyzeSummaryEvent AppPolicyAnalyzeSummaryEvent optional
  The policy analyze summary event
• ↳ policyRemediateSummaryEvent AppPolicyRemediateSummaryEvent optional
  The policy remediate summary event
• ↳ policyAnalyzeStackSummaryEvent AppPolicyAnalyzeStackSummaryEvent optional
  The policy analyze stack summary event
• ↳ startDebuggingEvent AppStartDebuggingEvent optional
  The start debugging event
• ↳ progressEvent AppProgressEvent optional
  The progress event
• ↳ errorEvent AppErrorEvent optional
  The error event

Responses

Creates new journal entries for the specified update. Journal entries record the progression of resource operations during an update, tracking state transitions for each resource. The include_non_activated query parameter controls whether non-activated events are included. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID
• include_non_activated boolean query optional
  When true, includes events that have not yet been activated; when false or omitted, only activated events are returned

Request Body

• entries array[AppJournalEntry] optional
  List of entries
• ↳ version integer required
  Version of the journal entry format.
• ↳ kind enum required
  Kind of journal entry.
  Values: 0, 1, 2, 3, 4, 5, 6, 7
• ↳ sequenceID integer required
  Sequence ID of the operation.
• ↳ operationID integer required
  ID of the operation this journal entry is associated with.
• ↳ removeOld integer required
  ID for the delete Operation that this journal entry is associated with.
• ↳ removeNew integer required
  ID for the delete Operation that this journal entry is associated with.
• ↳ pendingReplacementOld integer optional
  PendingReplacementOld is the index of the resource that’s to be marked as pending replacement
• ↳ pendingReplacementNew integer optional
  PendingReplacementNew is the operation ID of the new resource to be marked as pending replacement
• ↳ deleteOld integer optional
  DeleteOld is the index of the resource that’s to be marked as deleted.
• ↳ deleteNew integer optional
  DeleteNew is the operation ID of the new resource to be marked as deleted.
• ↳ state AppResourceV3 optional
  The resource state associated with this journal entry.
• ↳ operation AppOperationV2 optional
  The operation associated with this journal entry, if any.
• ↳ isRefresh boolean optional
  If true, this journal entry is part of a refresh operation.
• ↳ secretsProvider AppSecretsProvidersV1 optional
  The secrets manager associated with this journal entry, if any.
• ↳ newSnapshot AppDeploymentV3 optional
  NewSnapshot is the new snapshot that this journal entry is associated with.

Responses

Appends a log entry to the specified update’s log stream. Log entries are used to record diagnostic messages, status information, and other output generated during a stack update operation. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• kind string required
  The kind
• fields map[string]object required
  The fields

Responses

Renews the lease for a service-managed update that is currently in progress. Leases prevent concurrent operations on the same stack and must be periodically renewed to indicate the update is still active. The renewal duration must be between 0 and 300 seconds. Returns 409 if the update is not currently in progress.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• token string required
  The current, valid lease token. DEPRECATED as of Pulumi API version 5+. Pulumi API will expect the update token in the Authorization header instead of this property. This property will be removed when the minimum supported API version on the service is raised to 5.
• duration integer required
  The duration for which to renew the lease in seconds (maximum 300).

Responses

Returns all stacks that reference the specified stack as a dependency in their Pulumi programs (via StackReference). This is useful for understanding the impact of changes to a stack, as downstream stacks may consume outputs from this stack. The response includes each referencing stack’s organization, project, name, and version.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Responses

Encrypts a single plaintext value using the stack’s encryption key. The request body contains the plaintext value to encrypt. The response contains the base64-encoded ciphertext. For encrypting multiple values in a single request, use the BatchEncryptValue endpoint instead. Returns 413 if the request body exceeds the maximum allowed content size.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• plaintext array[string] required
  The value to encrypt.

Responses

Exports the current, complete state of the stack as an untyped deployment object. The response includes the deployment version, manifest (containing timestamps and plugin information), secrets providers configuration, and the full array of resources with their URNs, types, inputs, outputs, and dependency information. This endpoint is commonly used for stack state backup, migration between backends, or programmatic inspection of resource states.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Responses

Exports the complete stack state at a specific historical update version, rather than the current version. This allows retrieving the deployment snapshot as it existed after a particular update completed. The response format is identical to the ExportStack endpoint. Returns 400 if the version parameter is invalid, or 404 if the specified version does not exist for this stack.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• version integer path required
  The stack update version number

Responses

Imports a deployment state snapshot into the specified stack, replacing the current state. The request body must contain a complete untyped deployment object with the same format returned by the ExportStack endpoint. This is commonly used for state migration between backends, state repair, or restoring from backup. Returns 400 if the deployment contains encrypted secrets from a different stack. Returns 409 if another update is currently in progress on the stack.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• version integer optional
  The schema version of the encoded deployment.
• features array[string] optional
  An optional list of features used by this deployment. The CLI will error when reading a deployment that uses a feature that is not supported by that version of the CLI. Only honored when version is 4 or greater.
• deployment object optional
  The opaque Pulumi deployment payload. Treated as a raw JSON value so the contents are preserved verbatim across client and server versions.

Responses

Returns metadata about a stack including the requesting user’s permission level and the stack’s notification settings (such as whether to notify on update success or failure). This endpoint provides access control and configuration metadata without returning the full stack details.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Responses

Updates the notification settings for a stack, controlling whether notifications are sent on update success or failure. The request body specifies the notification preferences. Returns the updated stack metadata including the new notification settings.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• notifyUpdateFailure boolean required
  Whether to send notifications on update failure.
• notifyUpdateSuccess boolean required
  Whether to send notifications on update success.

Responses

Changes the ownership of the specified stack to the provided user. Returns the identity of the previous owner.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• name string required
  The user’s display name.
• githubLogin string required
  The user’s login name.
• avatarUrl string required
  The URL of the user’s avatar image.
• email string optional
  IMPORTANT: The email address of the user is only included on a few admin-only APIs. For nearly all APIs that return a UserInfo object, this will not be provided. considered sensitive information.

Responses

Creates a new preview update for the given stack. A preview shows what changes would be made without actually applying them, similar to a dry run. This only creates the update record; the update must subsequently be started via the StartUpdateForPreview endpoint. Enforces stack update concurrency checks.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• name string required
  Properties from the Project file. Subset of pack.Package.
• runtime string required
  The runtime
• main string required
  The main entry point
• description string required
  The description
• options AppUpdateOptions required
  The options
• ↳ localPolicyPackPaths array[string] required
  File system paths to local policy packs to apply during this update.
• ↳ color string required
  Terminal color mode for output rendering (e.g. ‘always’, ’never’, ‘auto’).
• ↳ dryRun boolean required
  If true, perform a preview without actually applying changes.
• ↳ parallel integer required
  Maximum number of resource operations to perform in parallel. 0 or -1 for unlimited.
• ↳ showConfig boolean required
  If true, include configuration values in the update output.
• ↳ showReplacementSteps boolean required
  If true, include detailed replacement steps in the update output.
• ↳ showNames boolean required
  If true, include unchanged resources in the update output.
• ↳ summary boolean required
  If true, only show a summary of changes rather than full details.
• ↳ debug boolean required
  If true, enable verbose debug logging during the update.
• config map[string]AppConfigValue required
  Configuration values.
• metadata AppUpdateMetadata required
  The metadata
• ↳ message string required
  Message is an optional message associated with the update.
• ↳ environment map[string]string required
  Environment contains optional data from the deploying environment. e.g. the current source code control commit information.

Responses

Returns the current status and results of a preview update, including whether it is still in progress, succeeded, or failed. Supports pagination of results via the continuationToken query parameter.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID
• continuationToken string query optional
  Continuation token for paginated results

Responses

Starts execution of a previously created preview update. The update must have been created via CreateUpdateForPreview first. Returns a lease token and version number for tracking the update. Returns 404 if the update does not exist, or 409 if another update is already in progress on the stack.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• tags map[string]string optional
  Tags contains an updated set of Tags for the stack. If non-nil, will replace the current set of tags associated with the stack.
• journalVersion integer optional
  JournalVersion indicates the maximum journal version the client supports. If 0, journaling is not supported.

Responses

Requests cancellation of a service-managed update that is currently in progress. The update must have been started (returns 409 if it has not). Returns 404 if the specified update does not exist. The cancellation is processed asynchronously and the update will transition to a cancelled state.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Responses

Marks a service-managed update as complete. The request body must include the final status of the update. Returns 400 if the status is unrecognized. Returns 409 if the update has not started, has been cancelled, has already timed out, or has already completed. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• status enum required
  The current status
  Values: not started, requested, running, failed, succeeded, cancelled

Responses

Returns the engine events for the specified update. Engine events represent individual resource operations and diagnostic messages produced during the update. Supports pagination via continuation tokens and filtering by engine event type codes or resource URN. The include_non_activated parameter controls whether events not yet marked as activated are included.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID
• continuationToken string query optional
  Continuation token for paginated results
• include_non_activated boolean query optional
  When true, includes events that have not yet been activated; when false or omitted, only activated events are returned
• type array query optional
  Filter results to only include events matching these engine event type codes
• urn string query optional
  Filter results to only include events for the specified resource URN

Responses

Records a single engine event sent from the Pulumi CLI during a stack update. Engine events represent individual resource operations or diagnostic messages. For better performance, consider using RecordEngineEventBatch to send multiple events in a single request. Returns 400 if no event data is provided, or 404 if the update does not exist. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• sequence integer required

  Sequence is a unique, and monotonically increasing number for each engine event sent to the Pulumi Service. Since events may be sent concurrently, and/or delayed via network routing, the sequence number is to ensure events can be placed into a total ordering.

  • No two events can have the same sequence number.
  • Events with a lower sequence number must have been emitted before those with a higher sequence number.
• timestamp integer required
  Timestamp is a Unix timestamp (seconds) of when the event was emitted.
• cancelEvent AppCancelEvent optional
  The cancel event
• stdoutEvent AppStdoutEngineEvent optional
  The stdout event
• ↳ message string required
  The message content
• ↳ color string required
  The output color
• diagnosticEvent AppDiagnosticEvent optional
  The diagnostic event
• ↳ urn string optional
  The Pulumi URN
• ↳ prefix string optional
  The prefix
• ↳ message string required
  The message content
• ↳ color string required
  The output color
• ↳ severity string required
  Severity is one of “info”, “info#err”, “warning”, or “error”.
• ↳ streamID integer optional
  The stream identifier
• ↳ ephemeral boolean optional
  Whether ephemeral is enabled
• preludeEvent AppPreludeEvent optional
  The prelude event
• ↳ config map[string]string required
  Config contains the keys and values for the update. Encrypted configuration values may be blinded.
• summaryEvent AppSummaryEvent optional
  The summary event
• ↳ maybeCorrupt boolean required
  MaybeCorrupt is set if one or more of the resources is in an invalid state.
• ↳ durationSeconds integer required
  Duration is the number of seconds the update was executing.
• ↳ resourceChanges map[string]integer required
  ResourceChanges contains the count for resource change by type.
• ↳ PolicyPacks map[string]string required
  Policy Packs run during the update, as a map from policy pack name to version. For newer clients, the value is the version tag prefixed with v; for older clients it is the raw version.
• ↳ isPreview boolean required
  IsPreview indicates whether this is a preview or an update.
• resourcePreEvent AppResourcePreEvent optional
  The resource pre event
• ↳ metadata AppStepEventMetadata required
  The metadata
• ↳ planning boolean optional
  Whether planning is enabled
• resOutputsEvent AppResOutputsEvent optional
  The res outputs event
• ↳ metadata AppStepEventMetadata required
  The metadata
• ↳ planning boolean optional
  Whether planning is enabled
• resOpFailedEvent AppResOpFailedEvent optional
  The res op failed event
• ↳ metadata AppStepEventMetadata required
  The metadata
• ↳ status integer required
  The current status
• ↳ steps integer required
  The steps
• policyEvent AppPolicyEvent optional
  The policy event
• ↳ resourceUrn string optional
  The resource urn
• ↳ message string required
  The message content
• ↳ color string required
  The output color
• ↳ policyName string required
  The policy name
• ↳ policyPackName string required
  The policy pack name
• ↳ policyPackVersion string required
  The policy pack version
• ↳ policyPackVersionTag string required
  The policy pack version tag
• ↳ enforcementLevel string required
  EnforcementLevel is one of “warning”, “mandatory”, “remediate”, or “none”.
• ↳ severity string optional
  Severity is one of “low”, “medium”, “high”, or “critical”. An empty string is omitted and represents an unspecified severity.
• policyRemediationEvent AppPolicyRemediationEvent optional
  The policy remediation event
• ↳ resourceUrn string optional
  The resource urn
• ↳ color string required
  The output color
• ↳ policyName string required
  The policy name
• ↳ policyPackName string required
  The policy pack name
• ↳ policyPackVersion string required
  The policy pack version
• ↳ policyPackVersionTag string required
  The policy pack version tag
• ↳ before map[string]object optional
  Map of before
• ↳ after map[string]object optional
  Map of after
• policyLoadEvent AppPolicyLoadEvent optional
  The policy load event
• policyAnalyzeSummaryEvent AppPolicyAnalyzeSummaryEvent optional
  The policy analyze summary event
• ↳ resourceUrn string required
  The URN of the resource being analyzed.
• ↳ policyPackName string required
  The name of the policy pack.
• ↳ policyPackVersion string required
  The version of the policy pack.
• ↳ policyPackVersionTag string required
  The version tag of the policy pack.
• ↳ passed array[string] optional
  The names of resource policies that passed (i.e. did not produce any violations).
• ↳ failed array[string] optional
  The names of resource policies that failed (i.e. produced violations).
• policyRemediateSummaryEvent AppPolicyRemediateSummaryEvent optional
  The policy remediate summary event
• ↳ resourceUrn string required
  The URN of the resource being remediated.
• ↳ policyPackName string required
  The name of the policy pack.
• ↳ policyPackVersion string required
  The version of the policy pack.
• ↳ policyPackVersionTag string required
  The version tag of the policy pack.
• ↳ passed array[string] optional
  The names of resource policies that passed (i.e. did not produce any violations).
• ↳ failed array[string] optional
  The names of resource policies that failed (i.e. produced violations).
• policyAnalyzeStackSummaryEvent AppPolicyAnalyzeStackSummaryEvent optional
  The policy analyze stack summary event
• ↳ policyPackName string required
  The name of the policy pack.
• ↳ policyPackVersion string required
  The version of the policy pack.
• ↳ policyPackVersionTag string required
  The version tag of the policy pack.
• ↳ passed array[string] optional
  The names of stack policies that passed (i.e. did not produce any violations).
• ↳ failed array[string] optional
  The names of stack policies that failed (i.e. produced violations).
• startDebuggingEvent AppStartDebuggingEvent optional
  The start debugging event
• ↳ config map[string]object optional
  The configuration
• progressEvent AppProgressEvent optional
  The progress event
• ↳ type enum required
  The type of process (e.g. plugin download, plugin install).
  Values: plugin-download, plugin-install
• ↳ id string required
  A unique identifier for the process.
• ↳ message string required
  A message accompanying the process.
• ↳ received integer required
  The number of items completed so far (e.g. bytes received, items installed, etc.)
• ↳ total integer required
  The total number of items that must be completed.
• ↳ done boolean required
  True if and only if the process has completed.
• errorEvent AppErrorEvent optional
  The error event
• ↳ error string required
  Error is the error message.

Responses

Records a batch of engine events sent from the Pulumi CLI during a stack update. Engine events represent individual resource operations (create, update, delete, etc.) and diagnostic messages. Batching events reduces the number of API calls during an update. Returns 400 if no events are provided in the batch, or 404 if the update does not exist. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• events array[AppEngineEvent] required
  List of events
• ↳ sequence integer required

  Sequence is a unique, and monotonically increasing number for each engine event sent to the Pulumi Service. Since events may be sent concurrently, and/or delayed via network routing, the sequence number is to ensure events can be placed into a total ordering.

  • No two events can have the same sequence number.
  • Events with a lower sequence number must have been emitted before those with a higher sequence number.
• ↳ timestamp integer required
  Timestamp is a Unix timestamp (seconds) of when the event was emitted.
• ↳ cancelEvent AppCancelEvent optional
  The cancel event
• ↳ stdoutEvent AppStdoutEngineEvent optional
  The stdout event
• ↳ diagnosticEvent AppDiagnosticEvent optional
  The diagnostic event
• ↳ preludeEvent AppPreludeEvent optional
  The prelude event
• ↳ summaryEvent AppSummaryEvent optional
  The summary event
• ↳ resourcePreEvent AppResourcePreEvent optional
  The resource pre event
• ↳ resOutputsEvent AppResOutputsEvent optional
  The res outputs event
• ↳ resOpFailedEvent AppResOpFailedEvent optional
  The res op failed event
• ↳ policyEvent AppPolicyEvent optional
  The policy event
• ↳ policyRemediationEvent AppPolicyRemediationEvent optional
  The policy remediation event
• ↳ policyLoadEvent AppPolicyLoadEvent optional
  The policy load event
• ↳ policyAnalyzeSummaryEvent AppPolicyAnalyzeSummaryEvent optional
  The policy analyze summary event
• ↳ policyRemediateSummaryEvent AppPolicyRemediateSummaryEvent optional
  The policy remediate summary event
• ↳ policyAnalyzeStackSummaryEvent AppPolicyAnalyzeStackSummaryEvent optional
  The policy analyze stack summary event
• ↳ startDebuggingEvent AppStartDebuggingEvent optional
  The start debugging event
• ↳ progressEvent AppProgressEvent optional
  The progress event
• ↳ errorEvent AppErrorEvent optional
  The error event

Responses

Creates new journal entries for the specified update. Journal entries record the progression of resource operations during an update, tracking state transitions for each resource. The include_non_activated query parameter controls whether non-activated events are included. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID
• include_non_activated boolean query optional
  When true, includes events that have not yet been activated; when false or omitted, only activated events are returned

Request Body

• entries array[AppJournalEntry] optional
  List of entries
• ↳ version integer required
  Version of the journal entry format.
• ↳ kind enum required
  Kind of journal entry.
  Values: 0, 1, 2, 3, 4, 5, 6, 7
• ↳ sequenceID integer required
  Sequence ID of the operation.
• ↳ operationID integer required
  ID of the operation this journal entry is associated with.
• ↳ removeOld integer required
  ID for the delete Operation that this journal entry is associated with.
• ↳ removeNew integer required
  ID for the delete Operation that this journal entry is associated with.
• ↳ pendingReplacementOld integer optional
  PendingReplacementOld is the index of the resource that’s to be marked as pending replacement
• ↳ pendingReplacementNew integer optional
  PendingReplacementNew is the operation ID of the new resource to be marked as pending replacement
• ↳ deleteOld integer optional
  DeleteOld is the index of the resource that’s to be marked as deleted.
• ↳ deleteNew integer optional
  DeleteNew is the operation ID of the new resource to be marked as deleted.
• ↳ state AppResourceV3 optional
  The resource state associated with this journal entry.
• ↳ operation AppOperationV2 optional
  The operation associated with this journal entry, if any.
• ↳ isRefresh boolean optional
  If true, this journal entry is part of a refresh operation.
• ↳ secretsProvider AppSecretsProvidersV1 optional
  The secrets manager associated with this journal entry, if any.
• ↳ newSnapshot AppDeploymentV3 optional
  NewSnapshot is the new snapshot that this journal entry is associated with.

Responses

Appends a log entry to the specified update’s log stream. Log entries are used to record diagnostic messages, status information, and other output generated during a stack update operation. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• kind string required
  The kind
• fields map[string]object required
  The fields

Responses

Renews the lease for a service-managed update that is currently in progress. Leases prevent concurrent operations on the same stack and must be periodically renewed to indicate the update is still active. The renewal duration must be between 0 and 300 seconds. Returns 409 if the update is not currently in progress.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• token string required
  The current, valid lease token. DEPRECATED as of Pulumi API version 5+. Pulumi API will expect the update token in the Authorization header instead of this property. This property will be removed when the minimum supported API version on the service is raised to 5.
• duration integer required
  The duration for which to renew the lease in seconds (maximum 300).

Responses

Returns details of a specific preview operation identified by its update ID. The response includes the preview’s kind, start and end times, result status, resource changes summary, configuration, and environment details. Returns 404 if the specified update does not exist.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Responses

Returns a concise summary of a specific preview operation, including the update kind, result status, start and end times, and resource change counts. This is a lighter-weight alternative to GetStackPreview when full update details are not needed. Returns 404 if the specified update does not exist.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Responses

Creates a new refresh update for the given stack. A refresh synchronizes the stack’s state with the actual state of the cloud resources, detecting any drift. This only creates the update record; the update must subsequently be started via the StartUpdateForRefresh endpoint. Enforces stack update concurrency checks.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name

Request Body

• name string required
  Properties from the Project file. Subset of pack.Package.
• runtime string required
  The runtime
• main string required
  The main entry point
• description string required
  The description
• options AppUpdateOptions required
  The options
• ↳ localPolicyPackPaths array[string] required
  File system paths to local policy packs to apply during this update.
• ↳ color string required
  Terminal color mode for output rendering (e.g. ‘always’, ’never’, ‘auto’).
• ↳ dryRun boolean required
  If true, perform a preview without actually applying changes.
• ↳ parallel integer required
  Maximum number of resource operations to perform in parallel. 0 or -1 for unlimited.
• ↳ showConfig boolean required
  If true, include configuration values in the update output.
• ↳ showReplacementSteps boolean required
  If true, include detailed replacement steps in the update output.
• ↳ showNames boolean required
  If true, include unchanged resources in the update output.
• ↳ summary boolean required
  If true, only show a summary of changes rather than full details.
• ↳ debug boolean required
  If true, enable verbose debug logging during the update.
• config map[string]AppConfigValue required
  Configuration values.
• metadata AppUpdateMetadata required
  The metadata
• ↳ message string required
  Message is an optional message associated with the update.
• ↳ environment map[string]string required
  Environment contains optional data from the deploying environment. e.g. the current source code control commit information.

Responses

Returns the current status and results of a refresh update, including whether it is still in progress, succeeded, or failed. Supports pagination of results via the continuationToken query parameter.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID
• continuationToken string query optional
  Continuation token for paginated results

Responses

Starts execution of a previously created refresh update. The update must have been created via CreateUpdateForRefresh first. Returns a lease token and version number for tracking the update. Returns 404 if the update does not exist, or 409 if another update is already in progress on the stack.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• tags map[string]string optional
  Tags contains an updated set of Tags for the stack. If non-nil, will replace the current set of tags associated with the stack.
• journalVersion integer optional
  JournalVersion indicates the maximum journal version the client supports. If 0, journaling is not supported.

Responses

Requests cancellation of a service-managed update that is currently in progress. The update must have been started (returns 409 if it has not). Returns 404 if the specified update does not exist. The cancellation is processed asynchronously and the update will transition to a cancelled state.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Responses

Uploads a new checkpoint (deployment state snapshot) for a service-managed update that is currently in progress. The checkpoint contains the complete current state of all resources. The request must contain a valid checkpoint object. Returns 403 for preview operations since previews do not modify actual state. Returns 409 if the update has not started, has been cancelled, timed out, or already completed. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• isInvalid boolean required
  Whether invalid
• version integer required
  The version number
• features array[string] optional
  The features
• deployment object optional
  The deployment data

Responses

Uploads a checkpoint delta for a service-managed update that is currently in progress. Rather than uploading the complete checkpoint state, this endpoint accepts an incremental delta that is applied to the existing checkpoint, reducing the payload size. The delta is persisted in the format as provided. Supports checksum validation for data integrity. Returns 403 for preview operations since previews do not modify actual state. Returns 409 if the update has not started, has been cancelled, timed out, or already completed. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• version integer required
  Protocol version.
• checkpointHash string required
  SHA256 hash of the result of aplying the DeploymentDelta to the previously saved deployment.
• sequenceNumber integer required
  Idempotency key incremented by the client on every PATCH call within the same update.
• deploymentDelta object optional
  Textual diff that recovers the desired deployment JSON when applied to the previously saved deployment JSON.

Responses

Uploads a checkpoint for a service-managed update as a verbatim byte array, bypassing JSON marshalling. Unlike PatchUpdateCheckpoint which accepts a structured deployment object and re-serializes it (which may compact data), this endpoint preserves the exact bytes provided by the client and uploads them directly to blob storage. This maintains byte-level fidelity of the checkpoint data. Returns 403 for preview operations. Returns 409 if the update has not started, has been cancelled, timed out, or already completed. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• version integer required
  The version number
• untypedDeployment object optional
  The untyped deployment
• sequenceNumber integer required
  Idempotency key incremented by the client on every PATCH call within the same update.

Responses

Marks a service-managed update as complete. The request body must include the final status of the update. Returns 400 if the status is unrecognized. Returns 409 if the update has not started, has been cancelled, has already timed out, or has already completed. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• status enum required
  The current status
  Values: not started, requested, running, failed, succeeded, cancelled

Responses

Returns the engine events for the specified update. Engine events represent individual resource operations and diagnostic messages produced during the update. Supports pagination via continuation tokens and filtering by engine event type codes or resource URN. The include_non_activated parameter controls whether events not yet marked as activated are included.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID
• continuationToken string query optional
  Continuation token for paginated results
• include_non_activated boolean query optional
  When true, includes events that have not yet been activated; when false or omitted, only activated events are returned
• type array query optional
  Filter results to only include events matching these engine event type codes
• urn string query optional
  Filter results to only include events for the specified resource URN

Responses

Records a single engine event sent from the Pulumi CLI during a stack update. Engine events represent individual resource operations or diagnostic messages. For better performance, consider using RecordEngineEventBatch to send multiple events in a single request. Returns 400 if no event data is provided, or 404 if the update does not exist. Requires update token authentication.

Request Parameters

• orgName string path required
  The organization name
• projectName string path required
  The project name
• stackName string path required
  The stack name
• updateID string path required
  The update ID

Request Body

• sequence integer required

  Sequence is a unique, and monotonically increasing number for each engine event sent to the Pulumi Service. Since events may be sent concurrently, and/or delayed via network routing, the sequence number is to ensure events can be placed into a total ordering.

  • No two events can have the same sequence number.
  • Events with a lower sequence number must have been emitted before those with a higher sequence number.
• timestamp integer required
  Timestamp is a Unix timestamp (seconds) of when the event was emitted.
• cancelEvent AppCancelEvent optional
  The cancel event
• stdoutEvent AppStdoutEngineEvent optional
  The stdout event
• ↳ message string required
  The message content
• ↳ color string required
  The output color
• diagnosticEvent AppDiagnosticEvent optional
  The diagnostic event
• ↳ urn string optional
  The Pulumi URN
• ↳ prefix string optional
  The prefix
• ↳ message string required
  The message content
• ↳ color string required
  The output color
• ↳ severity string required
  Severity is one of “info”, “info#err”, “warning”, or “error”.
• ↳ streamID integer optional
  The stream identifier
• ↳ ephemeral boolean optional
  Whether ephemeral is enabled
• preludeEvent AppPreludeEvent optional
  The prelude event
• ↳ config map[string]string required
  Config contains the keys and values for the update. Encrypted configuration values may be blinded.
• summaryEvent AppSummaryEvent optional
  The summary event
• ↳ maybeCorrupt boolean required
  MaybeCorrupt is set if one or more of the resources is in an invalid state.
• ↳ durationSeconds integer required
  Duration is the number of seconds the update was executing.
• ↳ resourceChanges map[string]integer required
  ResourceChanges contains the count for resource change by type.
• ↳ PolicyPacks map[string]string required
  Policy Packs run during the update, as a map from policy pack name to version. For newer clients, the value is the version tag prefixed with v; for older clients it is the raw version.
• ↳ isPreview boolean required
  IsPreview indicates whether this is a preview or an update.
• resourcePreEvent AppResourcePreEvent optional
  The resource pre event
• ↳ metadata AppStepEventMetadata required
  The metadata
• ↳ planning boolean optional
  Whether planning is enabled
• resOutputsEvent AppResOutputsEvent optional
  The res outputs event
• ↳ metadata AppStepEventMetadata required
  The metadata
• ↳ planning boolean optional
  Whether planning is enabled
• resOpFailedEvent AppResOpFailedEvent optional
  The res op failed event
• ↳ metadata AppStepEventMetadata required
  The metadata
• ↳ status integer required
  The current status
• ↳ steps integer required
  The steps
• policyEvent AppPolicyEvent optional
  The policy event
• ↳ resourceUrn string optional
  The resource urn
• ↳ message string required
  The message content
• ↳ color string required
  The output color
• ↳ policyName string required
  The policy name
• ↳ policyPackName string required
  The policy pack name
• ↳ policyPackVersion string required
  The policy pack version
• ↳ policyPackVersionTag string required
  The policy pack version tag
• ↳ enforcementLevel string required
  EnforcementLevel is one of “warning”, “mandatory”, “remediate”, or “none”.
• ↳ severity string optional
  Severity is one of “low”, “medium”, “high”, or “critical”. An empty string is omitted and represents an unspecified severity.
• policyRemediationEvent AppPolicyRemediationEvent optional
  The policy remediation event
• ↳ resourceUrn string optional
  The resource urn
• ↳ color string required
  The output color
• ↳ policyName string required
  The policy name
• ↳ policyPackName string required
  The policy pack name
• ↳ policyPackVersion string required
  The policy pack version
• ↳ policyPackVersionTag string required
  The policy pack version tag
• ↳ before map[string]object optional
  Map of before
• ↳ after map[string]object optional
  Map of after
• policyLoadEvent AppPolicyLoadEvent optional
  The policy load event
• policyAnalyzeSummaryEvent AppPolicyAnalyzeSummaryEvent optional
  The policy analyze summary event
• ↳ resourceUrn string required
  The URN of the resource being analyzed.
• ↳ policyPackName string required
  The name of the policy pack.
• ↳ policyPackVersion string required
  The version of the policy pack.
• ↳ policyPackVersionTag string required
  The version tag of the policy pack.
• ↳ passed array[string] optional
  The names of resource policies that passed (i.e. did not produce any violations).
• ↳ failed array[string] optional
  The names of resource policies that failed (i.e. produced violations).
• policyRemediateSummaryEvent AppPolicyRemediateSummaryEvent optional
  The policy remediate summary event
• ↳ resourceUrn string required
  The URN of the resource being remediated.
• ↳ policyPackName string required
  The name of the policy pack.
• ↳ policyPackVersion string required
  The version of the policy pack.
• ↳ policyPackVersionTag string required
  The version tag of the policy pack.
• ↳ passed array[string] optional
  The names of resource policies that passed (i.e. did not produce any violations).
• ↳ failed array[string] optional
  The names of resource policies that failed (i.e. produced violations).
• policyAnalyzeStackSummaryEvent AppPolicyAnalyzeStackSummaryEvent optional
  The policy analyze stack summary event
• ↳ policyPackName string required
  The name of the policy pack.
• ↳ policyPackVersion string required
  The version of the policy pack.
• ↳ policyPackVersionTag string required
  The version tag of the policy pack.
• ↳ passed array[string] optional
  The names of stack policies that passed (i.e. did not produce any violations).
• ↳ failed array[string] optional
  The names of stack policies that failed (i.e. produced violations).
• startDebuggingEvent AppStartDebuggingEvent optional
  The start debugging event
• ↳ config map[string]object optional
  The configuration
• progressEvent AppProgressEvent optional
  The progress event
• ↳ type enum required
  The type of process (e.g. plugin download, plugin install).
  Values: plugin-download, plugin-install
• ↳ id string required
  A unique identifier for the process.
• ↳ message string required
  A message accompanying the process.
• ↳ received integer required
  The number of items completed so far (e.g. bytes received, items installed, etc.)
• ↳ total integer required
  The total number of items that must be completed.
• ↳ done boolean required
  True if and only if the process has completed.
• errorEvent AppErrorEvent optional
  The error event
• ↳ error string required
  Error is the error message.