Pulumi
API integration

list_all_pulumi_agents_signups

Get a proof-of-work challenge for Pulumi agent signup. Returns the challengeID and the challengeData the proof of work is computed over. The challenge expires after a short window if not consumed.

create_a_pulumi_agents_signup

Create a new Pulumi Cloud account programmatically for an agent. Returns: accessToken, accessTokenValidUntil, claimToken, claimTokenValidUntil, userInfo. The account is created in a pre-claim state; the human takes ownership via the returned claim URL. Required: challengeID, challengeResult.

get_single_pulumi_signup_validate_by_id

Validate an agent signup claim token in Pulumi Cloud. Verifies the token is still valid and returns the agent claim response (AgentClaimResponse) — details about the agent and the resources it created; upstream docs do not enumerate its fields. 404 if unknown, expired, or canceled. Required: id.

create_a_pulumi_agent_claim

Preview (dryRun=true) or commit a Pulumi agent claim for an organization. On commit the agent's stacks transfer to the destination organization and the agent's organization and access token are soft-deleted; conflicts or failures are returned and block the change. Returns: agent, conflicts, failures, and 3 more. Required: org_name, claimToken.

list_all_pulumi_claim_status

Fetch details about recent Pulumi agent claims for an organization. Returns a JSON claim status object whose fields follow the upstream AgentClaimsStatus schema. Required: org_name.

list_all_pulumi_capabilities

List the set of capabilities that the Pulumi Cloud service supports. Requires no parameters. Returns: capability, configuration, version.

list_all_pulumi_change_gates

List change gates in a Pulumi Cloud organization, currently for a single entity. Returns matching change gate objects with id and content-type-specific attributes. Required: org_name. Supports optional entityType and qualifiedName filters.

create_a_pulumi_change_gate

Create a change gate in a Pulumi Cloud organization that enforces approval requirements before changes can be applied to a protected entity. Returns the created change gate as an opaque object with id and content-type-specific attributes. Required: org_name, enabled, name, rule, target.

get_single_pulumi_change_gate_by_id

Get a single change gate by id in a Pulumi Cloud organization, including its approval requirements and the entity it protects. Returns the change gate as an opaque object with id and content-type-specific attributes. Required: id, org_name.

update_a_pulumi_change_gate_by_id

Update the configuration of an existing change gate, such as its approval requirements or protected entity, in a Pulumi Cloud organization. Returns the updated change gate as an opaque object with id and content-type-specific attributes. Required: id, org_name, enabled, name, rule, target.

delete_a_pulumi_change_gate_by_id

Delete a change gate by id, removing the approval requirement from the protected entity so changes no longer require approval. Returns an empty 204 response on success. Required: id, org_name.

create_a_pulumi_apply

Apply an approved Pulumi change request to execute its proposed infrastructure changes. Returns the apply result: id and schema-specific attributes per the upstream ChangeRequestApplyResult definition. The change request must have the required number of approvals; a conflict returns…. Required: org_name, change_request_id.

list_all_pulumi_cli_versions

Get version information about the Pulumi CLI. Returns: latestDevVersion, latestVersion, oldestWithoutWarning. Takes no required parameters.

list_all_pulumi_org_integrations

List a summary of all VCS integrations (GitHub, GitLab, Azure DevOps, Custom) configured for a Pulumi organization. Returns: avatarUrl, baseUrl, hasIndividualAccess, host, id, name, vcsProvider. Required: org_name.

list_all_pulumi_integrations_azure_devops

List the Azure DevOps integrations configured for a Pulumi organization. Returns one integration record per item, each including its id; field-level detail beyond the id is not enumerated in the available documentation. Required: org_name.

create_a_pulumi_integrations_azure_devop

Create an Azure DevOps integration for a Pulumi organization. Returns an empty 204 response on success. Required: org_name. The request body must specify the Azure DevOps organization and project; 409 is returned if an integration already exists for that project.

get_single_pulumi_integrations_azure_devop_by_id

Get a single Azure DevOps integration by id from a Pulumi organization. Returns the integration record including its id; field-level detail beyond the id is not enumerated in the available documentation. Required: id, org_name.

update_a_pulumi_integrations_azure_devop_by_id

Update an existing Azure DevOps integration's settings by id, including its Azure DevOps organization, project, or authentication configuration. Returns an empty 204 response on success. Required: id, org_name.

delete_a_pulumi_integrations_azure_devop_by_id

Delete a specific Azure DevOps integration from a Pulumi organization by id. Returns an empty 204 response on success. Required: id, org_name.

list_all_pulumi_azure_devops_access_status

Get the current user's Azure DevOps access status for a Pulumi organization, including whether they have a valid OAuth token. Returns: availableOrgs, hasIntegration, hasUserToken. Required: org_name.

list_all_pulumi_setup_organizations

List the Azure DevOps organizations available to the current Pulumi user for VCS integration setup. Returns: accountUrl, hasRequiredPermissions, id, name. Requires an active Azure DevOps OAuth token. Required: org_name.

list_all_pulumi_organization_projects

List the Azure DevOps projects in an Azure DevOps organization that are available to the current user in Pulumi. Returns: id, name. Required: org_name, ado_org_name.

list_all_pulumi_integrations_bitbuckets

List the BitBucket integrations configured for a Pulumi organization. Returns: authType, authUser, avatarUrl, disableDetailedDiff, disableNeoSummaries, id, installed, valid, and 4 more. Entries carry the linked BitBucket workspace metadata and validity status, as typed by the upstream ListBitBucketIntegrationsResponse schema. Required: org_name.

create_a_pulumi_integrations_bitbucket

Create a BitBucket integration for a Pulumi organization. Requires a BitBucket workspace UUID and optionally configures authentication via the user's BitBucket OAuth token or a workspace access token / PAT. Returns an empty 204 response on success; the call fails if an integration already exists for the workspace. Required: org_name, workspaceSlug, workspaceUuid.

get_single_pulumi_integrations_bitbucket_by_id

Get a single BitBucket integration by id. Returns: id, installed, valid, and 9 more. The record's full details — the linked BitBucket workspace, authentication configuration, and validity status — are typed by the upstream BitBucketIntegrationDetails schema, which the published reference does not enumerate field-by-field. Required: id, org_name.

update_a_pulumi_integrations_bitbucket_by_id

Update a BitBucket integration's settings, such as PR comment preferences and AI summary options. Returns an empty 204 response on success. Required: id, org_name.

delete_a_pulumi_integrations_bitbucket_by_id

Delete a BitBucket integration by id, removing the integration and cleaning up its associated webhooks and access tokens. Returns an empty 204 response on success. Required: id, org_name.

list_all_pulumi_bitbucket_access_status

Get a user's BitBucket access status in Pulumi for an organization, including whether they have a valid BitBucket OAuth token and which BitBucket workspaces are available for new integrations. Returns the BitBucketAccessStatusResponse object; the API reference does not enumerate its fields. Required: org_name.

list_all_pulumi_integrations_customs

List all custom VCS integrations configured for a Pulumi organization. Returns each integration's configuration, webhook URL, and configured repositories; webhook secrets are not included in list responses. Required: org_name.

create_a_pulumi_integrations_custom

Create a custom VCS integration connecting a self-hosted or third-party VCS (e.g. Gitea, Forgejo, Bitbucket Server) to Pulumi Deployments. Returns the created integration including its configuration, webhook URL, and one-time HMAC secret for signature verification. Required: org_name, baseUrl, environment, name.

get_single_pulumi_integrations_custom_by_id

Get a specific custom VCS integration by id. Returns the integration details including its configuration, webhook URL, and configured repositories; the webhook secret is not included (it is returned only at creation time or when regenerated). Required: id, org_name.

update_a_pulumi_integrations_custom_by_id

Update a custom VCS integration's settings by id; only provided fields are modified. Returns the updated integration (configuration, webhook URL, repositories). Set regenerateWebhookSecret to true to rotate the webhook HMAC secret, invalidating the previous secret immediately. Required: id, org_name.

delete_a_pulumi_integrations_custom_by_id

Delete a custom VCS integration by id, permanently removing the integration, its webhook endpoint, and all configured repository associations. Returns an empty 204 response on success. Required: id, org_name.

create_a_pulumi_repo

Add a repository to a custom VCS integration in Pulumi Cloud. Returns an empty 204 response on success; a duplicate repository name is rejected. Required: org_name, integration_id, name.

list_all_pulumi_repos

List repositories available through a Pulumi Cloud VCS integration. Returns the collection of repositories the integration exposes. Required: org_name, provider, integration_id.

pulumi_repos_bulk_delete

Remove a repository from a custom VCS integration in Pulumi Cloud; the repository is identified by the name provided in the request body. Returns an empty 204 response on success. Required: org_name, integration_id, name.

list_all_pulumi_integrations_githubs

List the GitHub App integrations configured for a Pulumi organization. Returns: installationUrl, integrations. Required: org_name.

create_a_pulumi_integrations_github

Start GitHub App setup for a Pulumi organization. Returns the setup response carrying the installation URL and state for completing the GitHub App installation flow. Required: org_name.

get_single_pulumi_integrations_github_by_id

Get a single GitHub App integration by id in a Pulumi organization. Returns: accountID, accountName, avatarUrl, created, disableCodeAccessForReviews, disableDetailedDiff, disableDraftPRComments, disableNeoSummaries, disablePRComments, ghUrls, hasContentsPermission, hasMembersPermission, id, individualAuthEnabled, and 4 more. Required: org_name, id.

update_a_pulumi_integrations_github_by_id

Update a GitHub App integration's settings in a Pulumi organization. Returns an empty 204 response on success. Required: id, org_name.

delete_a_pulumi_integrations_github_by_id

Delete a GitHub App integration from a Pulumi organization. Returns an empty 204 response on success. Required: org_name, id.

list_all_pulumi_integrations_github_enterprises

List all GitHub Enterprise Server integrations for a Pulumi organization; returns only self-hosted GitHub App installations. Returns: installationUrl, integrations. Required: org_name.

get_single_pulumi_integrations_github_enterprise_by_id

Get a specific GitHub Enterprise Server integration in a Pulumi organization by id. Returns: accountID, accountName, avatarUrl, created, disableCodeAccessForReviews, disableDetailedDiff, disableDraftPRComments, disableNeoSummaries, disablePRComments, ghUrls, hasContentsPermission, hasMembersPermission, id, and 5 more. Required: id, org_name.

update_a_pulumi_integrations_github_enterprise_by_id

Update the settings of a GitHub Enterprise Server integration in a Pulumi organization by id. Returns an empty 204 response on success. Required: id, org_name.

delete_a_pulumi_integrations_github_enterprise_by_id

Delete a GitHub Enterprise Server integration from a Pulumi organization by id. Returns an empty 204 response on success. Required: id, org_name.

get_single_pulumi_github_enterprise_user_auth_by_id

Get the GitHub Enterprise identity the current Pulumi Cloud user has linked for an organization's GitHub Enterprise integration's host. Returns: connectedAt, githubId, login. Returns 404 if the user has not linked an identity on that host. Required: id, org_name.

pulumi_github_enterprise_user_auths_bulk_delete

Disconnect the current Pulumi Cloud user's linked GitHub Enterprise identity for an organization's GitHub Enterprise integration's host by deleting the stored user access token and identity rows. Returns an empty 204 response on success. Idempotent — succeeds even if no identity is currently linked. Required: org_name, integration_id.

get_single_pulumi_user_auth_authorize_by_id

Get the GitHub Enterprise OAuth authorization URL that links the current user's identity for a Pulumi organization's GitHub Enterprise integration. Returns: authorizeUrl. Required: org_name, id.

list_all_pulumi_user_auth_members

List the github.com logins of organization members who have linked a GitHub Enterprise identity on the given integration's host. Returns: linkedLogins. Required: org_name, integration_id.

list_all_pulumi_github_access_status

Get the current user's GitHub OAuth access status for a Pulumi Cloud organization. Returns the access-status record with id and attributes describing the user's GitHub OAuth state. Required: org_name.

create_a_pulumi_github_claim

Claim an existing, unlinked Pulumi GitHub App installation and link it to the organization. Returns the claimed integration details (id plus attributes). Idempotent when already linked; fails if the installation is linked to a different organization. Required: org_name, installationId.

list_all_pulumi_github_claimables

List the Pulumi GitHub App installations that are not linked to any organization and can be claimed for this one. Returns: installations. Required: org_name.

list_all_pulumi_integrations_gitlabs

List the GitLab integrations configured for a Pulumi organization, including their validity status and linked group metadata. Returns per-integration records with id, created_at, updated_at. Required: org_name.

create_a_pulumi_integrations_gitlab

Create a GitLab integration for a Pulumi organization. Returns an empty 204 response on success. Requires a GitLab group ID and org_name; returns 409 if an integration already exists for the specified group. Required: org_name, gitLabGroupId.

get_single_pulumi_integrations_gitlab_by_id

Get a specific GitLab integration configured for a Pulumi organization by its integration id. Returns: authUser, avatarUrl, disableDetailedDiff, disableNeoSummaries, disablePRComments, gitLabGroupId, gitLabOrg, groupAccessTokenExpiration, groupName, groupPath, id, installed, valid. Required: id, org_name.

update_a_pulumi_integrations_gitlab_by_id

Update a GitLab integration's settings, such as PR comment preferences and AI summary options. Returns an empty 204 response on success. Required: id, org_name.

delete_a_pulumi_integrations_gitlab_by_id

Delete a GitLab integration from a Pulumi organization, cleaning up its associated webhooks, access tokens, and group tokens. Returns an empty 204 response on success. Required: id, org_name.

list_all_pulumi_gitlab_access_status

Get the GitLab access status for a Pulumi Cloud organization. Returns the access status payload covering OAuth token validity, existing integrations, and available GitLab groups for new integrations. Required: org_name.

list_all_pulumi_repos_destinations

List Pulumi VCS repo destinations: repositories where the authenticated user can create new repos from templates via the integration. Returns: nextPageToken, repos. provider accepts github, gitlab, bitbucket, azure_devops, custom, or github_enterprise. Required: org_name, provider, integration_id.

list_all_pulumi_repo_branches

List the branches of a repository through a Pulumi Cloud VCS integration. Returns the ListVCSBranchesResponse object with upstream-defined fields; the published docs do not enumerate the response shape. Required: org_name, provider, integration_id, repo_id.

list_all_pulumi_member_stacks

List a Pulumi organization member's effective permissions for a stack, covering access inherited from the default role, team memberships, and explicitly assigned grants. Returns the member's access details (ListMemberStackPermissionsResponse). Required: org_name, user_login, project_name, stack_name.

list_all_pulumi_neo_member_usage_caps

List per-member Neo usage caps in Pulumi. Returns every organization member with their per-member monthly Neo usage cap, month-to-date Neo spend, and effective limit (the smaller of the per-member and org-level caps); caps are denominated in cents. Required: org_name.

update_a_pulumi_neo_member_usage_cap_by_id

Create or replace a single organization member's monthly Neo usage cap in Pulumi with an UpdateNeoMemberUsageCapRequest JSON body; the cap must be at least $10/month and is denominated in cents. Returns the cap record including updatedAt. Required: id, org_name, capCents.

delete_a_pulumi_neo_member_usage_cap_by_id

Remove a single organization member's monthly Neo usage cap in Pulumi, returning the member to only the org-level cap (if any). The operation is idempotent — deleting when no cap is set Returns an empty 204 response on success. Returns an empty 204 response on success. Required: id, org_name.

pulumi_org_stacks_search

Search an organization's stacks in Pulumi, returning a combined view of IaC-managed stacks and discovered stacks. Supports pagination, sorting, and filtering via the grid request body. Returns the ListOrganizationProjectsResponsev3 result set (Pulumi does not enumerate its fields). Required: org_name, filterModel, groupKeys, rowGroupCols, sortModel, valueCols.

list_all_pulumi_overviews

Get the aggregated overview for a Pulumi Cloud stack — its current state, recent activity, resource counts, and configuration combined into a single response. Returns the stack overview object (StackOverviewResponse); the upstream docs reference this schema by name only and do not enumerate its fields. Required: org_name, project_name, stack_name.

list_all_pulumi_latest_summaries

Get a human-readable summary of the most recent update to a Pulumi Cloud stack, with a tree view of resource changes. Returns a console update summary object with id and schema-specific attributes. Fails with 404 if the stack has no updates. Required: org_name, project_name, stack_name.

get_single_pulumi_update_summary_by_id

Get a human-readable summary of a specific Pulumi Cloud update by id, formatted like the CLI's 'pulumi up' output with a tree view of resource changes, create/update/delete counts, and the overall result. Returns the pre-rendered summary object; upstream does not document its field-level structure. Required: id, org_name, project_name, stack_name.

list_all_pulumi_update_summaries

Get a concise summary of a specific Pulumi Cloud stack update by version number — the lighter-weight alternative to the full update-detail endpoint. Returns a summary object carrying the update kind, result status, start and end times, and resource change counts; its field-level structure is not documented upstream. Required: org_name, project_name, stack_name, version.

list_all_pulumi_deployments_executors

Download the Pulumi Deployments executor binary for Linux/AMD64 - the component that runs inside a deployment container and executes Pulumi operations. Returns the raw binary as a stream with no structured fields. Intended for Pulumi-managed deployment runners.

list_all_pulumi_deployments_polls

Poll the Pulumi Deployments queue for the next available deployment job to execute. Returns the deployment's workflow definition object when work is available, or an empty 204 response on success when the queue is empty; agents should poll this endpoint repeatedly. Requires no parameters.

get_single_pulumi_deployment_status_by_id

Get the current execution status of a Pulumi Deployments run by id, to check whether the deployment is still active. Returns a JobStatus string: not-started, accepted, running, failed, succeeded, or skipped; succeeded, failed, and skipped are terminal. Required: id.

create_a_pulumi_aws_setup

Set up AWS infrastructure for a Pulumi Cloud ESC organization using provided static AWS credentials, sending an AWSSetupRequest JSON body. Returns the CloudSetupResult object; the upstream docs do not enumerate its fields. Required: org_name, accessKeyId, oidcRoleName, policyArn, secretAccessKey, sessionToken.

list_all_pulumi_sso_accounts

List the AWS accounts accessible with a Pulumi ESC CloudSetup AWS SSO session in an organization. Returns the ListCloudAccountsResponse payload of AWS accounts; the upstream docs enumerate no field-level shape for it. Required: org_name.

create_a_pulumi_sso_initiate

Initiate the AWS SSO setup flow for a Pulumi Cloud organization. Returns the AWSSSOInitiateResponse JSON payload for a successfully initiated flow; the source references this schema by name without enumerating its fields. Required: org_name, region, startUrl.

create_a_pulumi_sso_setup

Set up AWS infrastructure and ESC environments in Pulumi using AWS SSO for an organization. Returns a CloudSetupResult object; the Pulumi Cloud REST API documents this response only by type name and does not enumerate its fields. Required: org_name, accountId, accountRoleName, oidcRoleName, policyArn, region, sessionId.

list_all_pulumi_azure_accounts

List the Azure subscriptions in Pulumi Cloud that are accessible with the provided ARM session. Returns the list of accessible subscriptions (ListCloudAccountsResponse); the upstream reference does not expose its field-level shape. Required: org_name.

create_a_pulumi_azure_setup

Set up Azure infrastructure and ESC environments for a Pulumi organization using OAuth credentials. Returns the upstream CloudSetupResult object on success; the Pulumi Cloud REST API documentation does not enumerate its fields. Required: org_name, armSessionId, azureEnvironmentInfos, graphSessionId.

list_all_pulumi_gcp_accounts

List the GCP projects accessible with the provided OAuth session in Pulumi Cloud. Returns the ListCloudAccountsResponse payload of discovered accounts; system-generated (sys- prefixed) and pending-deletion projects are excluded. Required: org_name.

create_a_pulumi_gcp_setup

Set up GCP infrastructure for a Pulumi organization using OAuth credentials. Returns the setup result object; its fields are not enumerated in the available documentation. Required: org_name, gcpEnvironmentInfo, oauthSessionId.

list_all_pulumi_context_schemas

Get the JSON Schema of the Pulumi ESC built-in `context` object — the object environments interpolate as ${context...}. Takes no parameters. Returns the raw JSON Schema document describing the available context fields; its shape is invariant across callers and environments.

create_a_pulumi_decrypt_secret

Decrypt encrypted secret values in a Pulumi ESC environment definition. Returns the same definition with fn::secret values decrypted to plaintext (content-type-specific fields). Returns 413 if the content exceeds the maximum allowed size. Required: org_name, project_name, env_name, ciphertexts.

create_a_pulumi_draft

Create a new draft change request proposing changes to a Pulumi ESC environment as part of the approvals workflow. Returns a ChangeRequestRef with the new draft's id. Requires the Approvals feature to be enabled for the organization. Required: org_name, project_name, env_name.

get_single_pulumi_draft_by_id

Get the YAML definition of a draft change request for a Pulumi ESC environment. Returns the draft's environment definition as raw YAML (application/x-yaml). Required: id, org_name, project_name, env_name.

update_a_pulumi_draft_by_id

Update the YAML definition of a draft change request for a Pulumi ESC environment. Returns a ChangeRequestRef with the draft's id; the body carries the updated YAML. Requires the Approvals feature to be enabled for the organization. Required: id, org_name, project_name, env_name.

create_a_pulumi_draft_open

Open a draft of a Pulumi ESC environment for a change request, resolving all dynamic values, provider integrations, and secrets. Returns the open session ID (id) for subsequent reads. Requires the Approvals feature. Required: org_name, project_name, env_name, change_request_id.

create_a_pulumi_encrypt_secret

Encrypt plaintext secret values in a Pulumi ESC environment definition. Returns the same definition with those values encrypted using the environment's encryption key (content-type-specific fields mirroring the submitted definition). Required: org_name, project_name, env_name, plaintexts.

list_all_pulumi_referrers

List entities that reference a Pulumi ESC environment — other environments that import it and Pulumi stacks that use it in their configuration. Returns a paginated list of referrer records (the Pulumi REST API reference does not enumerate the per-referrer fields). Required: org_name, project_name, env_name. count accepts 1-500.

create_a_pulumi_rotate

Rotate the secrets of a Pulumi ESC environment: evaluates all fn::rotate declarations and rotates the corresponding secrets in their external systems. Returns: diagnostics, id, secretRotationEvent. Requires the secret rotation feature to be enabled; returns 409 if the…. Required: org_name, project_name, env_name, paths.

list_all_pulumi_rotate_histories

List a Pulumi ESC environment's secret rotation history — one entry per rotation of fn::rotate secrets. Returns the rotation-history document; the upstream reference does not enumerate its fields. Requires the secret rotation feature to be enabled for the organization. Required: org_name, project_name, env_name.

list_all_pulumi_settings

Get the current settings for a Pulumi ESC environment, including whether deletion protection is enabled. Returns: deletionProtected. Required: org_name, project_name, env_name.

pulumi_settings_bulk_update

Update the settings of a Pulumi ESC environment using a partial patch that currently supports toggling deletion protection; omitted fields retain their current values. Required: org_name, project_name, env_name.

list_all_pulumi_esc_providers

List all available Pulumi ESC providers — integrations that retrieve configuration and secrets from external sources (AWS, Azure, Google Cloud, HashiCorp Vault, 1Password) via fn::open in environment definitions. Returns the provider list response payload; the API reference does not enumerate its fields.

list_all_pulumi_esc_rotators

List all available Pulumi ESC secret rotators — integrations that automatically rotate secrets in external systems via the fn::rotate function in environment definitions. Returns the ListRotatorsResponse payload; upstream docs do not document its individual fields. Optionally filter by organization using the orgName query parameter.

list_all_pulumi_rotator_schemas

Get the JSON schema for a Pulumi ESC secret rotator by name. Returns a rotator-specific JSON Schema document describing the rotator's input parameters, output structure, and configuration options; fields vary per rotator. Required: rotator_name.

list_all_pulumi_graph_schemas

Get the Pulumi Insights graph query schema as JSON, describing the node types, edge types, field vocabularies, and engine limits graph queries support. Returns: edgeTypes, limits, metricOps, nodeTypes, schemaVersion. Pass 'Accept: text/markdown' for a Markdown guide; running graph queries requires entitlement.

create_a_pulumi_graph_query

Execute a graph selection query over a Pulumi organization's resource graph. Returns the GraphQueryResponse — either the matching subgraph or flat aggregation buckets, trimmed to the caller's visible stacks and accounts — with field-level shape defined by the graph query schema. Required: org_name, anchor.

create_a_pulumi_oauth_token

Exchange a credential for a Pulumi access token via grant_type — either a token exchange (send audience, subject_token, subject_token_type, requested_token_type) or a refresh-token grant (send refresh_token). Returns: access_token, expires_in, issued_token_type, refresh_token, scope, token_type, x-originalParamName.

list_all_pulumi_openapi_pulumi_specs

Get the OpenAPI v3 specification for the Pulumi Cloud REST API service. Returns the complete specification document as a single JSON object; its fields follow the OpenAPI v3 standard and are not enumerated per-field. Takes no parameters.

list_all_pulumi_org_agent_pools

List all agent pools configured for a Pulumi organization; each pool enables self-hosted deployment agents to run Pulumi Deployments on your own infrastructure. Returns: agentPools, defaultAgentPoolID. Required: org_name.

create_a_pulumi_org_agent_pool

Create an agent pool for a Pulumi organization to run self-hosted deployment agents on your own infrastructure. Returns: id, tokenValue. Required: org_name, description, name.

get_single_pulumi_org_agent_pool_by_id

Get a single Pulumi agent pool by id. Returns: agents, created, description, id, name. Required: id, org_name.

update_a_pulumi_org_agent_pool_by_id

Update a Pulumi agent pool's configuration (such as its name); only provided fields are updated and omitted fields remain unchanged. Returns: description, name. Required: id, org_name.

delete_a_pulumi_org_agent_pool_by_id

Delete a Pulumi agent pool by id. Deletion fails while any stack's deployment settings reference the pool unless force is set to true; force-deleting makes affected stacks fall back to Pulumi-managed infrastructure. Returns an empty 204 response on success. Required: id, org_name.

list_all_pulumi_assignments_lists

List entity assignments in a Pulumi organization. Returns the EntityAssignmentsResponse (id, attributes): every principal (users and teams) granted a permission set on the entity, plus the permission sets available for assignment on its type. Required: org_name, context, id.

update_a_pulumi_assignments_update_by_id

Grant, change, or revoke a user's direct assignment on an entity in Pulumi. Sending a permission set grants or replaces the user's grant on the entity; omitting it revokes the existing grant. Returns the UpdateEntityAssignmentResponse confirmation. Required: org_name, context, id, userId.

list_all_pulumi_auditlogs_event_types

List the catalog of audit log event types for a Pulumi organization. Returns the eventTypes catalog, each entry carrying event, displayName, description, authenticationFailure, requiresOrgAdmin, and requiresStackAdmin. Not paginated; sorted by event identifier. Required: org_name.

list_all_pulumi_export_configs

Get the organization's audit log export configuration in Pulumi. Returns the audit log export settings object with vendor-defined configuration fields, or 404 if the organization has not configured audit log export. Required: org_name.

update_a_pulumi_export_config_by_id

Create or update the organization's automated audit log export configuration in Pulumi, delivering audit events to an S3 bucket for retention and SIEM integration via an IAM role. Returns an empty 204 response on success. Only available on Business Critical edition. Required: org_name, newEnabled, newS3Configuration.

pulumi_export_configs_bulk_delete

Delete the organization's audit log export configuration in Pulumi. Returns an empty 204 response on success. Required: org_name. Removal is allowed even if the organization no longer has access to the feature.

create_a_pulumi_config_force

Force an audit log export for a Pulumi organization from a user-supplied timestamp to backfill data missed during an outage or permissions issue. Returns the AuditLogExportResult: id plus an attributes object whose schema-specific fields are defined upstream. Required: org_name.

create_a_pulumi_config_test

Test a Pulumi organization's audit log export configuration: checks whether the provided S3 export configuration (AuditLogsExportS3Config) can successfully write data. Returns the audit log export test result (AuditLogExportResult; fields not enumerated in the docs). Fails if audit log export is not available for the…. Required: org_name, iamRoleArn, s3BucketName.

list_all_pulumi_auditlogs_reader_kinds

Get the Pulumi audit logs reader kind for an organization, which indicates whether audit logs are being read from MySQL or DynamoDB. Returns the reader kind as a plain string. Required: org_name.

get_single_pulumi_policies_oidcissuer_by_id

Get the authentication policy associated with a specific OIDC issuer registration in a Pulumi organization. Returns: created, id, modified, policies, version. Required: id, org_name.

update_a_pulumi_auth_policy_by_id

Update an authentication policy for a Pulumi organization, replacing how its OIDC tokens are validated and what access they grant. Returns the updated policy: id and policies (decision, tokenType, teamName, userLogin, runnerID, authorizedPermissions, rules). Requires org_name, org_name, policyId, id, and a non-empty policies array. Required: id, org_name, policies.

create_a_pulumi_bulk_transfer_stack

Transfer all active stacks from one Pulumi organization to another, skipping deleted stacks; the source org is locked read-only until the transfer completes. Returns a plain string response body. Takes a JSON request body (TransferAllStacksRequest). Limited to organizations with at most 100 stacks. Required: org_name, fromOrg, toOrg.

list_all_pulumi_org_cmks

List all customer managed keys (CMKs) configured for a Pulumi Cloud organization, including their key identifiers, cloud provider details, enabled status, and which key is the default for new stacks. Returns key records as id plus attributes. Required: org_name.

create_a_pulumi_org_cmk

Create a customer managed key (CMK) for a Pulumi Cloud organization so secrets can be encrypted with the organization's own cloud provider key (e.g., an AWS KMS key). Returns the created key record as id plus attributes following the upstream CustomerManagedKey schema. Required: org_name, keyType, name.

pulumi_org_cmks_disable

Disable a customer managed key for a Pulumi Cloud organization so it can no longer encrypt new secrets, while existing secrets encrypted with the key remain accessible. Returns an empty 200 response on success. Required: org_name, key_id, destID.

create_a_pulumi_cmk_disable

Disable all customer managed keys (CMK) for a Pulumi organization, reverting secret encryption for new stacks to default Pulumi-managed encryption. Returns an empty 200 OK response on success. Required: org_name.

list_all_pulumi_cmk_migrations

List all key encryption key (KEK) migrations for a Pulumi Cloud organization, which track re-encryption of secrets during customer managed key rotation. Returns: id, state. Required: org_name.

create_a_pulumi_migration_retry

Retry failed key encryption key (KEK) migrations for a Pulumi organization. Re-attempts KEK migrations that failed due to transient errors while re-encrypting secrets during customer managed key rotation, without restarting the whole process. Returns an empty 200 response on success. Required: org_name.

create_a_pulumi_coherence_window_subgroup

Create a subgroup of a Pulumi Cloud stack update coherence window for a set of stacks that will be updated together. The JSON body carries the number of stacks that will take part (it must be positive). Returns: id. Required: org_name, window_id, size.

delete_a_pulumi_coherence_window_subgroup_by_id

Close a Pulumi Cloud coherence window subgroup by id so that no further update may join it. Returns an empty 204 response on success. Required: id, org_name, window_id.

list_all_pulumi_org_deployments

List all Pulumi Deployments executions across an organization, filtered to stacks the requesting user can access. Returns: deployments, itemsPerPage, total. Supports sort and asc; results default to descending order. Required: org_name.

list_all_pulumi_deployments_summaries

Get a Pulumi Deployments compute usage summary (deployment minutes) for an organization, bucketed by time granularity. Returns a summary record with id and attributes (aggregated per-bucket usage). Hourly is limited to a 2-day lookback. Required: org_name, granularity.

list_all_pulumi_deployments_usagereports

List aggregated deployment usage records for a Pulumi Cloud organization for self-reported deployment consumption and billing reconciliation. Returns an array of usage records with vendor-defined UsageRecord fields; lookbackDays controls how far back records are retrieved. Required: org_name.

list_all_pulumi_discovered_resources_summaries

Get the discovered-resource usage summary for a Pulumi organization over a lookback window. Returns: summary, tagKeys. lookbackDays and lookbackStart are optional but mutually exclusive — supply exactly one; hourly is limited to a 2-day lookback. Required: org_name, granularity.

list_all_pulumi_insights_scans_summaries

Get a summary of Insights scan usage for a Pulumi Cloud organization, grouped by the specified time granularity. Returns a resource-count summary object on success (schema GetResourceCountSummaryResponse; field shape not detailed in the API docs), or an empty 204 No Content response when no usage data exists. Required: org_name, granularity.

list_all_pulumi_org_invites

List all pending invitations for a Pulumi organization; each pending invite reserves a seat in the organization's seat limit. Returns each invite's id, email, role, roleId, sentBy, and sentAt. Required: org_name.

get_single_pulumi_org_invite_by_id

Get basic metadata for a Pulumi organization by validating an active invite ID — a reasonably secure way for non-members who know both the org name and the invite ID; returns 404 if the invite was accepted or canceled. Returns: avatarUrl, email, githubLogin, name, role. Required: id, org_name.

update_a_pulumi_org_invite_by_id

Accept a pending Pulumi organization invitation, adding the authenticated user as a member of the organization; returns 409 if the invite is not in the 'invited' state (already accepted or canceled). Returns an empty 204 response on success. Required: id, org_name.

delete_a_pulumi_org_invite_by_id

Cancel a pending Pulumi organization invitation, reclaiming the seat it reserves; Returns an empty 204 response on success. Returns an empty 204 response on success. Required: org_name, id.

pulumi_org_invites_resend

Resend a pending Pulumi organization invitation email, updating its sent timestamp to the current time; returns 404 if the invite was accepted or canceled. Returns an empty 204 response on success. Required: org_name, invite_id.

create_a_pulumi_invites_batch

Create multiple Pulumi organization invitations in one batch; each invitee receives an email with a role assignment (admin or member) and optional team assignments. Returns the batch invite result object with upstream-defined fields. Required: org_name, org_name. Pending invites count toward the organization's seat limit.

create_a_pulumi_invites_link

Create a shareable invite link for a Pulumi Cloud organization. Generates a join URL intended for copy/paste sharing — no email is sent and no email address is required in the request body. Returns the invite-link record including its id and upstream-defined attributes. Required: org_name, role.

create_a_pulumi_unverified_batch

Create multiple unverified email invitations to a Pulumi organization in one batch; invitees do not need existing or verified Pulumi accounts and will be prompted to create one when they accept. Returns the batch invite result payload (shape defined by the vendor's BatchCreateOrganizationInviteResponse schema). Required: org_name, invites.

create_a_pulumi_org_member

Add an existing Pulumi user to an organization with a built-in role. Returns the created member record: id and attributes (upstream OrganizationMember fields). The user must already have a Pulumi account; only built-in roles are assignable, and 409 applies if the user is already a member. Required: org_name, user_login, role.

list_all_pulumi_org_members

List the members of a Pulumi organization. Returns member records: userLogin, role, fgaRoleId, Suspended. Required: org_name. Defaults to frontend members; pass type=backend for identity-provider backend members, or includeSuspended=true as an org admin to include suspended members.

pulumi_org_members_bulk_update

Update a member's role within a Pulumi organization. Returns an empty 204 response on success. Set role (member, admin, or billingManager) for a built-in role or fgaRoleId for a custom role; fgaRoleId takes precedence when both are provided. Required: org_name, user_login.

pulumi_org_members_bulk_delete

Remove a user from a Pulumi organization, revoking their access to its resources and removing them from all teams they belong to. Returns an empty 204 response on success. Required: org_name, user_login. The caller cannot remove themselves from the organization.

list_all_pulumi_member_teams

List the teams a user belongs to within a Pulumi organization, including Pulumi-managed teams and teams synced from a backend identity provider. Returns: teams. Required: org_name, user.

list_all_pulumi_neo_token_budgets

Get the current Neo-token budget for a Pulumi organization — the Neo-token allowance and consumption for the binding (closest-to-exhaustion) in-force Neo limit. Returns 404 when no Neo-token cap applies to the organization. Required: org_name.

list_all_pulumi_tokens_summaries

Get the Neo AI agent token usage summary for a Pulumi Cloud organization, aggregated by time granularity over a lookback period. Returns: summary (per-period entries with resources, resourceHours, year, month) and tagKeys. May return an empty 204 response. Required: org_name, granularity.

list_all_pulumi_neo_usage_caps

Get the monthly Neo usage cap configured for a Pulumi Cloud organization. Returns the cap record with its id and the cap details under attributes; cap amounts are denominated in cents. Returns no content when no cap is set (the default). Required: org_name.

pulumi_neo_usage_caps_bulk_update

Create or replace the monthly Neo usage cap for a Pulumi Cloud organization. Returns the NeoUsageCap record including its id and its upstream-defined cap attributes (caps are denominated in cents). The cap must be at least $10/month; to remove the cap, use the DeleteNeoUsageCap operation. Required: org_name, capCents.

pulumi_neo_usage_caps_bulk_delete

Delete the monthly Neo usage cap for a Pulumi Cloud organization, returning it to the uncapped default. Idempotent: deleting when no cap is set still succeeds. Returns an empty 204 response on success. Required: org_name.

list_all_pulumi_oidc_issuers

List the OIDC issuer registrations of a Pulumi organization that establish trust with external identity providers for temporary credential token exchange. Returns: oidcIssuers. Required: org_name.

create_a_pulumi_oidc_issuer

Register a new OIDC issuer for a Pulumi organization to establish trust with an external identity provider (AWS, Azure, Google Cloud, GitHub Actions, or any OIDC-compliant IdP) for token exchange. Returns: created, id, issuer, jwks, lastUsed, maxExpiration, modified, name, thumbprints, url. Required: org_name, name, url.

get_single_pulumi_oidc_issuer_by_id

Get the details of a single OIDC issuer registration of a Pulumi organization by id, including its issuer URL and configuration. Returns: created, id, issuer, jwks, lastUsed, maxExpiration, modified, name, thumbprints, url. Required: id, org_name.

update_a_pulumi_oidc_issuer_by_id

Update an existing OIDC issuer registration of a Pulumi organization by id; the issuer URL cannot be changed after creation and the issuer name is required. Returns: created, id, issuer, jwks, lastUsed, maxExpiration, modified, name, thumbprints, url. Required: id, org_name.

delete_a_pulumi_oidc_issuer_by_id

Delete an OIDC issuer registration of a Pulumi organization by id, removing the trust relationship so its tokens can no longer be exchanged for temporary Pulumi Cloud credentials. Returns an empty 204 response on success. Required: org_name and id.

create_a_pulumi_issuer_regenerate_thumbprint

Regenerate the TLS certificate thumbprints for an OIDC issuer in Pulumi Cloud by re-fetching the identity provider's public keys. Returns: created, id, issuer, jwks, lastUsed, maxExpiration, modified, name, thumbprints, url. Cannot be used when the issuer's JWKS are statically configured. Required: org_name, issuer_id.

list_all_pulumi_packages_usages

List the stacks in a Pulumi organization that use a specific package, to track package adoption and plan upgrades or deprecations. Returns the package usage response object with provider-defined fields. Omitting packageName returns 400. Max 500 per page. Required: org_name.

list_all_pulumi_policygroups_metadata

Get an organization's high-level policy protection metrics from Pulumi Cloud — stacks protected by policy enforcement, total Policy Groups, and overall policy coverage statistics. Returns the vendor-defined PolicyGroupMetadata metrics object. Required: org_name.

pulumi_policygroup_batches_bulk_update

Apply multiple update operations to a Pulumi policy group in one batch, sending a JSON array of operations that are grouped by type (adds, removes) and processed in batches. Required: org_name, policy_group. Returns an empty 204 response on success.

list_all_pulumi_org_policypacks

List all complete Policy Packs in a Pulumi organization. Returns a Policy Pack list whose shape the source documents by reference (AppListPolicyPacksResponse). Required: org_name.

create_a_pulumi_org_policypack

Create a new Policy Pack for a Pulumi organization. Returns a Policy Pack object whose field set the source documents by reference (AppCreatePolicyPackResponse). The pack must contain at least one policy. Required: org_name, displayName, name, policies.

pulumi_org_policypacks_bulk_delete

Delete all versions of a Policy Pack from a Pulumi organization, including the associated packs stored in S3 and any applied versions. Returns an empty 204 response on success. Required: org_name, policy_pack_name. Enabled Policy Packs cannot be deleted.

list_all_pulumi_policypack_versions

Get a specific version of a Pulumi Policy Pack, including its metadata and the individual policy definitions it contains. Returns status entries for 200 (OK), 400 (version not yet complete), and 404 (not found). Required: org_name, policy_pack_name, version.

pulumi_policypack_versions_complete

Finalize publication of a Pulumi Policy Pack version by transitioning its publish status to complete, making it available for enforcement once the pack content has been uploaded. Returns an empty 204 response on success. Required: org_name, policy_pack_name, version. Returns 400 if the pack is already complete.

pulumi_policypack_versions_bulk_delete

Delete a specific version of a Pulumi Policy Pack and its associated pack content stored in S3. Returns status entries for 200 (OK), 404 (not found), and 409 (applied to Policy Groups). The pack version must be unapplied to be deleted. Required: org_name, policy_pack_name, version.

list_all_pulumi_version_schemas

Get the JSON configuration schema for a specific version of a Pulumi Policy Pack, defining each policy's configurable parameters, allowed values, defaults, and validation rules. Returns the JSON configuration schema document; fields are pack-specific. Required: org_name, policy_pack_name, version.

list_all_pulumi_policyresults_issues

List Pulumi Cloud policy issues for an organization — violations detected by Policy Packs during stack updates or continuous compliance scans. Each record covers the violating resource, policy details, enforcement level, severity, and triage status; advanced filtering uses the grid request body. Returns: groupData, policyIssues, rowCount. Required: org_name, filterModel, groupKeys, rowGroupCols, sortModel, valueCols.

get_single_pulumi_policyresults_issue_by_id

Get a single Pulumi Cloud policy issue by id. The record's field-level shape follows the upstream GetPolicyIssueResponse schema, covering the violating resource, the policy pack and policy name, enforcement level, severity, and triage status. Returns: policy, policyIssue, policyPack. Required: id, org_name.

update_a_pulumi_policyresults_issue_by_id

Update a Pulumi Cloud policy issue's triage status and other mutable fields by id. All body fields are optional; status accepts open, in_progress, or ignored (fixed and by_design cannot be set manually). Returns: policy, policyIssue, policyPack. Required: id, org_name.

create_a_pulumi_issues_export

Export the policy issues of a Pulumi organization to CSV for offline analysis or reporting; issues are violations detected by Policy Packs during stack updates or continuous compliance scans. Returns the CSV document as plain text, with each row covering the violating resource, policy name, enforcement level, and severity. Required: org_name, filterModel, groupKeys, rowGroupCols, sortModel, valueCols.

list_all_pulumi_policyresults_metadata

Get an organization's high-level policy compliance statistics in Pulumi, including total violation counts, breakdowns by severity and enforcement level, and trends over time. Returns the PolicyResultsMetadata statistics object. Required: org_name.

list_all_pulumi_policyresults_policies

List policy compliance data for a Pulumi Cloud organization, grouped by policy pack and policy name with compliant and violating stack counts per policy rule. Returns the ListPoliciesComplianceResponse object; filtering and pagination are controlled via the grid request body. Required: org_name, filterModel, groupKeys, rowGroupCols, sortModel, valueCols.

list_all_pulumi_resources_summaries

Get a Pulumi organization's resources under management (RUM) and resource hours under management (RHUM) usage summary by time granularity. Returns: summary, tagKeys. Required: org_name, granularity. lookbackDays and lookbackStart are mutually exclusive; hourly granularity is limited to a 2-day lookback.

list_all_pulumi_org_restore_stacks

List the most recently deleted stacks in a Pulumi Cloud organization to find restore candidates. Returns deleted-stack records with id and attributes (further fields defined by the upstream ListDeletedStacksResponse schema). Up to 25 stacks are returned. Required: org_name.

create_a_pulumi_org_restore_stack

Restore a soft-deleted stack in a Pulumi Cloud organization by its program identifier. Returns an empty 204 response on success. Requires org_name and restore_stack_id. Only available when the organization has the restore stacks feature enabled, and fails if a live stack with the same name already exists. Required: org_name, restore_stack_id, stackName.

list_all_pulumi_org_roles

List custom roles for a Pulumi organization filtered by UX purpose; by default only roles contained within the calling user's permissions are returned. Returns roles with id, name, description. Required: org_name, uxPurpose.

create_a_pulumi_org_role

Create a custom role for a Pulumi organization. Returns the created role: id, name, description. Role definitions are limited to 2000 entries per permission descriptor group and 1 MB serialized size; exceeding either returns a 400 error. Required: org_name.

get_single_pulumi_org_role_by_id

Get a custom role by id in a Pulumi organization. Returns the role's details: id, name, description. Required: id, org_name.

update_a_pulumi_org_role_by_id

Update a custom role's name, description, or permission scopes in a Pulumi organization; changes apply immediately to assigned members and teams. Returns the updated role: id, name, description. Same 2000-entry and 1 MB limits apply. Required: id, org_name.

delete_a_pulumi_org_role_by_id

Delete a custom role from a Pulumi organization by id; deletion revokes the permissions it granted to assigned members and teams. Deleting a role that is currently assigned requires force. Returns an empty 204 response on success. Required: id, org_name.

list_all_pulumi_roles_scopes

List all permission scopes that can be assigned to custom roles in a Pulumi Cloud organization. Returns a map of scope categories (e.g. stacks, teams, organization settings) to the permission scopes that can be granted or denied. Required: org_name.

list_all_pulumi_role_teams

List the Pulumi Cloud teams that hold a specific organization role. Returns the upstream ListTeamsWithRoleResponse payload as-is; the vendor does not enumerate its fields. Required: org_name, role_id.

list_all_pulumi_role_tokens

List the Pulumi organization tokens that have been assigned to a specific custom role, so administrators can audit which tokens hold particular permission levels and manage least-privilege access. Returns a ListAccessTokensResponse payload of matching token records. Required: org_name, role_id.

list_all_pulumi_role_users

List the users assigned a specific role in a Pulumi organization. Returns the ListUsersWithRoleResponse JSON payload — the upstream reference names this schema without documenting its fields. Required: org_name, role_id.

list_all_pulumi_org_samls

Get the SAML configuration for a Pulumi Cloud organization. Returns: entityId, idpSsoDescriptor, nameIdFormat, organization, ssoUrl, validUntil, validationError. Required: org_name.

pulumi_org_samls_bulk_update

Update the SAML configuration for a SAML-backed Pulumi Cloud organization. Returns: entityId, idpSsoDescriptor, nameIdFormat, organization, ssoUrl, validUntil, validationError. Required: org_name.

list_all_pulumi_saml_admins

List the SAML admins for a Pulumi organization. Returns: samlAdmins. Required: org_name.

update_a_pulumi_saml_admin_by_id

Update the SAML admin of a Pulumi organization to the given user. Each organization supports only one SAML admin, and the new admin must not belong to other organizations. Returns an empty 204 response on success. Required: org_name, user_login.

list_all_pulumi_search_column_sets

Get column-set aggregations for Pulumi Cloud resource search: unique values and counts for a field such as 'type', 'package', or 'project', used to populate filter dropdowns and faceted navigation. Returns an object whose keys are unique values of the requested field and whose values are aggregation results with resource counts. Required: org_name.

list_all_pulumi_resources_dashboards

Get resource dashboard aggregations for a Pulumi organization. Returns a ResourceSearchResult aggregations object with resource counts grouped by package and other dimensions, for display on organization dashboard cards. Required: org_name.

list_all_pulumi_resources_exports

Export a Pulumi organization's resource search results as a CSV file download, using the same query filters as the standard resource search. Returns the exported resource data as a text/plain CSV file. Required: org_name.

list_all_pulumi_resources_parses

Convert a natural language question into a structured Pulumi resource search query using AI. Returns the AI-generated structured query as an opaque response object; the upstream reference does not enumerate its fields. AI assist requires an Enterprise subscription. Required: org_name.

list_all_pulumi_search_resourcesv_2_s

Search Pulumi Cloud resources in an organization by query string, with sorting, grouping, and faceting. Returns matching resource records with urn, name, type, stack, project, created, and modified fields. Required: org_name. Page-based pagination caps at 10,000 results; use cursor for larger sets (Enterprise plans only).

list_all_pulumi_secrets_summaries

Get the ESC secret-hours usage summary for a Pulumi organization. Returns the usage summary object defined by Pulumi's GetResourceCountSummaryResponse schema; a 204 No Content is returned when no usage data exists. Exactly one of lookbackDays or lookbackStart must be provided. Required: org_name, granularity.

create_a_pulumi_teams_github

Create a Pulumi team backed by an existing GitHub team; membership stays managed in GitHub while stack access is controlled in Pulumi Cloud. Returns the created team object with name, kind, members, and the remaining team fields under attributes. Returns 409 if a team with the same name already exists. Required: org_name, githubTeamID.

create_a_pulumi_teams_pulumi

Create a Pulumi-managed team in an organization — one whose membership is managed by Pulumi rather than GitHub or GitLab. Returns the created Team object including its name and description. Max display name length is 100 characters; a duplicate team name returns a 409. Required: org_name, description, displayName, name.

create_a_pulumi_team_enable_team_role

Enable custom role-based access control for a Pulumi Cloud team so it can be assigned custom roles beyond the default team roles. Returns the created role descriptor record: id plus content-type-specific descriptor attributes. Fails with 400 if a role with this name already exists. Required: org_name, team_name.

list_all_pulumi_team_roles

List the roles assigned to a Pulumi Cloud team. A team currently has a single role. Returns the upstream ListTeamRolesResponse payload; Pulumi does not document its individual fields. Required: org_name, team_name.

update_a_pulumi_team_role_by_id

Assign or replace the role on a Pulumi Cloud team by upserting the team's role assignment; only one role can be assigned per team. Returns an empty 204 response on success. Required: org_name, team_name, id.

delete_a_pulumi_team_role_by_id

Remove a custom role assignment from a Pulumi Cloud team, revoking the permissions the role granted to its members. Returns an empty 204 response on success. Required: org_name, team_name, id.

list_all_pulumi_team_tokens

List a Pulumi team's access tokens, which inherit the team's stack permissions for scoped CI/CD access. Returns: continuationToken, tokens. Token values are never returned. Required: org_name, team_name.

create_a_pulumi_team_token

Create a Pulumi team access token for CI/CD pipelines scoped to the team's stacks. Returns: id, tokenValue. Required: org_name, team_name, org_name, team_name, name. name must be unique across the organization (max 40 characters).

delete_a_pulumi_team_token_by_id

Permanently revoke and delete a Pulumi team access token by id. Pipelines and automation using the token immediately lose access to the team's stacks; this cannot be undone. Returns an empty 204 response on success. Required: id, org_name, team_name.

list_all_pulumi_template_configurations

Look up the configuration Pulumi Cloud stores for a project template, using the template's url as a key into the organization's template sources. Returns the stored configuration object; the API docs do not enumerate its fields. Required: org_name.

list_all_pulumi_template_downloads

Download the tar template archive for a Pulumi organization. Returns the archive as an application/x-tar binary stream containing the template's project files and configuration (binary response, not a JSON object). Required: org_name.

list_all_pulumi_template_readmes

Get the README for a Pulumi organization template as raw Markdown text (text/markdown), not a JSON object — the entire response body is the README content. Returns 404 if the template has no README.md file, 422 if the README content is invalid. Required: org_name.

list_all_pulumi_templates_sources

List all template collections (sources) configured for a Pulumi organization, including where project templates are sourced from, such as Git repositories. Returns per-collection records with id, name, url, and templates. Required: org_name.

create_a_pulumi_templates_source

Create a new template collection (source) for a Pulumi organization so members can scaffold new stacks from its templates, such as a Git repository. Returns: destination, destinationURL, error, id, isValid, name, sourceURL. Required: org_name, name, sourceURL.

update_a_pulumi_templates_source_by_id

Update an existing template collection (source) for a Pulumi organization, modifying its source URL, name, or other configuration. Returns: destination, destinationURL, error, id, isValid, name, sourceURL. Required: id, org_name.

delete_a_pulumi_templates_source_by_id

Delete a template collection (source) from a Pulumi organization; its templates will no longer be available to members when creating new stacks. Returns an empty 200 response on success. Required: id, org_name.

list_all_pulumi_org_tokens

List organization access tokens for a Pulumi organization. Returns token metadata: id, name, description, plus a continuationToken for paging. Required: org_name. Max 1000 per page.

create_a_pulumi_org_token

Create a new organization access token for a Pulumi organization, scoped to the org for CI/CD automation. Returns: id, tokenValue. Required: org_name, description, expires, admin, name.

delete_a_pulumi_org_token_by_id

Delete an organization access token in Pulumi by id, immediately revoking access for any pipelines using it. Returns an empty 204 response on success. Required: org_name, id. This action cannot be undone.

get_single_pulumi_events_stream_by_id

Stream events for a specific Pulumi agent task over Server-Sent Events. Existing events are delivered immediately, then the connection stays open to deliver new events in real time until the task completes. Returns a text/event-stream in which each data frame carries a JSON-encoded agent console event. Required: id, org_name.

create_a_pulumi_account_ownership

Change the owner of a Pulumi Cloud Insights account to a new user. Returns the previous owner's identity object with UserInfo-defined fields. Preview endpoint. Required: org_name, account_name, avatarUrl, githubLogin, name.

list_all_pulumi_policy_packs

List the policy packs configured to analyze resources in a Pulumi Insights account. Returns the account's policy packs (record fields follow the upstream Insights policy pack schema). Required: org_name, account_name.

create_a_pulumi_account_resource

Create or update discovered resources in a Pulumi Insights account, reporting scanner resource state via the request body. Returns an empty 204 response on success. Required: org_name, account_name, resources.

get_single_pulumi_account_resource_by_id

Get a discovered Pulumi Insights resource by id, including its current version details. Returns the discovered resource object with its version details. Required: id, org_name, account_name.

list_all_pulumi_resources_references

List discovered resources with their referenced resources for a batch of resource identifiers in a Pulumi Cloud Insights account. Returns an array of resource-with-references records per the upstream InsightsResourceWithReferences schema (fields not enumerated in the docs). Required: org_name, account_name, resourceIdentifiers.

list_all_pulumi_resource_edges

List the relationships (edges) between a discovered resource and other resources in a Pulumi Cloud Insights account. Returns the upstream-defined edge-list payload (attributes) — the API reference does not enumerate its fields. Max 500 results per…. Required: org_name, account_name, resource_type_and_id.

list_all_pulumi_resource_references

Get a discovered cloud resource in a Pulumi Insights account along with its referenced (related) resources. Returns a record whose fields are content-type-specific, as defined by the upstream InsightsResourceWithReferences schema. Required: org_name, account_name, resource_type_and_id.

list_all_pulumi_resource_stack_edges

List the Pulumi stacks that manage a specified discovered resource in Pulumi Insights. Returns the managing stacks; stack object fields are not enumerated in the API docs. resource_type_and_id must be double-URL-encoded as 'type::id'. Required: org_name, account_name, resource_type_and_id.

list_all_pulumi_version_edges

List the relationships (edges) between a specific version of a discovered resource and other resources in a Pulumi Insights account. Returns: edges, nextToken. Required: org_name, account_name, resource_type_and_id, resource_version. Max 500 per page.

pulumi_policy_results_bulk_update

Update the policy evaluation results for a specific version of a discovered resource in Pulumi Insights. Returns an empty 204 response on success. Required: org_name, account_name, resource_type_and_id, resource_version, claimId, results.

create_a_pulumi_scan_cancel

Cancel the running resource discovery scan for a Pulumi Cloud Insights account. Returns an empty 204 response on success. Required: org_name, account_name.

create_a_pulumi_scan_pause

Pause execution of future scheduled scans for a Pulumi Cloud Insights account. Returns an empty 204 response on success. Required: org_name, account_name.

create_a_pulumi_scan_resume

Resume scheduled scans for a Pulumi Insights account, re-enabling execution of future scheduled scans. Returns an empty 204 response on success. Required: org_name, account_name.

list_all_pulumi_scan_settings

Read the scheduled scan configuration for a Pulumi Insights account, including scan frequency and schedule details. Returns: batchSize, listConcurrency, readConcurrency, readTimeout, paused, scheduleCron. Required: org_name, account_name.

pulumi_scan_settings_bulk_update

Update the scheduled scan configuration for a Pulumi Insights account, such as scan frequency and schedule. Returns an empty 204 response on success. Required: org_name, account_name, paused.

list_all_pulumi_account_teams

List the teams that have been granted access to a Pulumi Cloud Insights account. Returns the JSON payload defined by the upstream ListTeamsByInsightsAccountResponse schema; its fields are not enumerated in the discovered documentation. Required: org_name, account_name.

pulumi_account_teams_bulk_update

Change the permissions a team has on a Pulumi Cloud Insights account, applying the change to every child account beneath it; a missing grant is created automatically and a request matching the current permission is a no-op. Sends the JSON body defined by the upstream UpdateTeamInsightsAccountPermissionsRequest schema; its fields are not enumerated…. Required: org_name, account_name, team_name.

list_all_pulumi_migrations

List the resources of a Terraform-backed Pulumi stack in Pulumi Insights, each annotated with a migrationStatus relative to an optional comparison stack; resources matching the target stack are reported as Migrated. Returns: continuationToken, resources. Required: org_name, project_name, stack_name.

pulumi_migrations_bulk_update

Create or update a migration annotation on a discovered resource in Pulumi Insights, identified by its URN in the request body. Returns an empty 204 response on success. Requires org_name, project_name, stack_name, and urn; at least one of note or statusOverride must be non-empty, and statusOverride, if provided, must be Migrated. Required: org_name, project_name, stack_name, resourceUrn.

pulumi_migrations_bulk_delete

Remove a migration annotation from a discovered resource in Pulumi Insights. Returns an empty 204 response on success. Requires org_name, project_name, stack_name, and resourceUrn (URN of the resource to remove the annotation from). Required: org_name, project_name, stack_name, resourceUrn.

create_a_pulumi_code_generate

Generate Pulumi code that imports discovered resources into a Pulumi stack. Returns the InsightsImportCodeResponse JSON; the Pulumi Cloud API documents this response and its request body by schema name (InsightsImportCodeRequest) only. Invalid language or URNs are rejected. Preview endpoint. Required: org_name, language, urns.

pulumi_insightstrial_accepts_bulk_update

Accept Insights billing charges for the specified organization in Pulumi, enabling metered billing for resource discovery. Returns an empty 204 response on success. Required: org_name.

pulumi_insightstrial_denies_bulk_update

Terminate the Insights trial for a Pulumi organization, removing all associated accounts. Returns an empty 204 response on success. Required: org_name.

list_all_pulumi_insightstrial_summaries

Get the Insights trial usage summary for a Pulumi Cloud organization, including resource counts and remaining trial capacity. Returns a TrialUsageSummary object; the upstream reference lists this schema without enumerating its fields. Required: org_name.

pulumi_update_results_bulk_update

Update the policy evaluation results for a specific Pulumi Cloud stack update version. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, version, claimId, results.

get_single_pulumi_version_doc_by_id

Get the Pulumi registry API documentation for a single package resource or function identified by its URL-encoded type token. Returns the documentation object with content-type-specific fields (JSON GetPackageDocsResponse, or raw markdown via Accept). Required: id, source, publisher, name, version.

list_all_pulumi_version_examples

List Pulumi registry code examples for a specific package version, aggregated across the package's resources and functions and sorted by type token, then by example position. Returns: examples, language, navUrl, totalCount, version. Required: source, publisher, name, version.

list_all_pulumi_version_installations

Get a Pulumi registry package version's installation configuration as an ordered list of content nodes. The node fields are content-type-specific and defined upstream; Accept: text/markdown returns the guide as a raw markdown string. Required: source, publisher, name, version. Returns 404 when the version does not exist or has no installation…

list_all_pulumi_version_navs

Get the package navigation for a Pulumi registry package version: a flat list of modules in schema-declaration order. Returns the navigation object with content-type-specific fields (JSON or markdown via Accept); depth=summary yields module names and counts, depth=full adds resources and functions. Required: source, publisher, name, version.

list_all_pulumi_registry_terraform_modules

List Terraform modules in the Pulumi Cloud registry, covering public modules plus private modules in namespaces the caller can access. Returns per entry: name, publisher, source, system, latestVersion, updatedAt. Optional filters: name (prefix), namespace. Paginated, 100 per page default. Preview endpoint; shape may change.

list_all_pulumi_annotations

Get a stack annotation by kind in Pulumi Cloud. Returns 404 if the annotation does not exist. Required: org_name, project_name, stack_name, kind.

pulumi_annotations_bulk_update

Create or update a stack annotation by kind in Pulumi Cloud (upsert). Returns an empty 204 response on success. Supports optimistic concurrency control: when version is supplied, the update fails with a conflict if the annotation changed since it was read. Required: org_name, project_name, stack_name, kind.

create_a_pulumi_batch_encrypt

Encrypt a batch of plaintext values with a Pulumi stack's encryption key in a single request. Returns a map of each submitted plaintext value to its base64-encoded ciphertext. Returns 413 if the request body exceeds the maximum allowed content size. Required: org_name, project_name, stack_name, plaintexts.

create_a_pulumi_begin_update

Begin a Pulumi stack update in one optimized call combining update creation, start, deployment export, and stack fetch. Returns the combined data needed to begin engine execution (upstream AppBeginUpdateResponse schema; fields not enumerated in the source docs). Returns…. Required: org_name, project_name, stack_name, program, updateKind.

pulumi_collaborators_bulk_delete

Revoke a user's direct permission to access a Pulumi stack. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, user_name. Only explicitly granted permissions are removed; permissions inherited from team membership or organization defaults are unaffected.

list_all_pulumi_configs

Get the service-managed configuration for a Pulumi Cloud stack — the ESC environment reference pointing the stack at service-backed config, used in place of the local stack config file. Returns: encryptedKey, encryptionSalt, environment, secretsProvider. Required: org_name, project_name, stack_name. 404 if none exists.

pulumi_configs_bulk_update

Update a Pulumi Cloud stack's service-managed configuration to point it at an ESC (service-backed) environment. Returns the updated config: environment, secretsProvider, encryptedKey, encryptionSalt (last three deprecated — omit them). Required: org_name, project_name, stack_name, environment. 400 if the environment reference is invalid or not…

pulumi_configs_bulk_delete

Delete a Pulumi Cloud stack's service-managed configuration (the ESC environment reference), causing the CLI to fall back to the local stack config file. Requires org_name, project_name, and stack_name. Returns an empty 204 response on success. Required: org_name, project_name, stack_name.

create_a_pulumi_decrypt_log_batch_decryption

Record an audit log entry for a batch decryption event performed by a third-party secrets provider (e.g. AWS KMS, Azure Key Vault, or HashiCorp Vault) against a Pulumi Cloud stack, where decryption happens client-side. Returns an empty 204 response on success. Requires org_name, project_name, and stack_name. Required: org_name, project_name, stack_name.

create_a_pulumi_decrypt_log_decryption

Report a third-party secret decryption event for a Pulumi Cloud stack. Records an audit log entry when a stack secret was decrypted client-side by an external secrets provider such as AWS KMS, Azure Key Vault, or HashiCorp Vault, so the CLI can report that decryption occurred. Returns an empty 204 response on success. Required: org_name, project_name, stack_name.

pulumi_deployments_caches_bulk_delete

Clear all cached dependency and build artifacts for a Pulumi Deployments stack, forcing a clean build on the next deployment (e.g. when cached dependencies become stale or corrupted). Returns an empty 200 response on success. Required: org_name, project_name, stack_name.

create_a_pulumi_drift_schedule

Create a drift detection schedule for a Pulumi Cloud stack using Pulumi Deployments. Returns the created ScheduledAction with its id, scheduleCron, and autoRemediate settings. The stack must have deployment settings configured, and setting autoRemediate to true requires…. Required: org_name, project_name, stack_name.

update_a_pulumi_drift_schedule_by_id

Update the configuration of an existing drift detection schedule for a Pulumi Cloud stack. Returns the updated ScheduledAction with its id, scheduleCron, and autoRemediate settings. Only future executions are affected; past drift detection runs are not modified, and…. Required: id, org_name, project_name, stack_name.

list_all_pulumi_deployments_settings

Get the Pulumi Deployments settings configured for a stack in Pulumi. Returns: agentPoolID, cacheOptions, executorContext, gitHub, operationContext, source, sourceContext, tag, vcs, version. Required: org_name, project_name, stack_name. Returns 404 when the stack has no deployment settings.

create_a_pulumi_deployments_setting

Create or merge Pulumi Deployments settings for a stack; null patch values remove properties, non-object values are replaced, and objects merge. Returns: agentPoolID, cacheOptions, executorContext, gitHub, source, tag, vcs, version, and 2 more. Required: org_name, project_name, stack_name. Requires Team Growth or higher subscription.

pulumi_deployments_settings_bulk_delete

Delete all Pulumi Deployments settings for a stack, after which it can no longer run deployments until new settings are configured. Returns a boolean success indicator. Required: org_name, project_name, stack_name. Active schedules (drift detection, TTL, or custom) may be affected.

create_a_pulumi_ttl_schedule

Create a TTL schedule for a Pulumi Cloud stack that destroys its cloud resources at an expiration time, optionally deleting the stack afterwards. Returns: created, definition, id, kind, lastExecuted, modified, nextExecution, orgID, paused, and 2 more. The stack must have deployment settings configured. Required: org_name, project_name, stack_name.

update_a_pulumi_ttl_schedule_by_id

Update an existing TTL schedule for a Pulumi Cloud stack, changing when its resources are destroyed or if the stack is deleted afterwards. Returns: created, definition, id, kind, lastExecuted, modified, nextExecution, orgID, paused, and 2 more. Timestamp must be a valid future date-time. Required: id, org_name, project_name, stack_name.

list_all_pulumi_deployments_versions

Get a specific Pulumi Deployments execution by its version number within a stack. Returns: configuration, created, id, initiator, jobs, latestVersion, modified, pulumiOperation, requestedBy, status, version. Required: org_name, project_name, stack_name, version.

list_all_pulumi_deployment_updates

List all stack updates produced by a Pulumi Deployments deployment execution; a single deployment may produce one or more updates. Returns: githubCommitInfo, info, latestVersion, policyPacks, requestedBy, requestedByToken, updateID, version. Required: org_name, project_name, stack_name, deployment_id.

list_all_pulumi_downstreamreferences

List all Pulumi stacks that reference the specified stack as a dependency in their Pulumi programs via StackReference. Returns each referencing stack's organization, project, name, and version. Required: org_name, project_name, stack_name.

list_all_pulumi_drift_runs

List drift detection runs for a Pulumi stack. Returns each drift run's id along with whether drift was detected and any remediation actions taken. Required: org_name, project_name, stack_name. Max 100 per page.

get_single_pulumi_drift_run_by_id

Get a single drift detection run for a Pulumi stack by id. Returns the drift run's id along with whether drift was detected and details of any detection and remediation updates. Required: id, org_name, project_name, stack_name.

list_all_pulumi_drift_status

Get the current drift detection status for a Pulumi Cloud stack — whether drift was detected, when the last drift check ran, and details of any detected differences. Returns the StackDriftStatus record as id plus an attributes object holding the drift fields. Required: org_name, project_name, stack_name.

create_a_pulumi_import

Import a deployment state snapshot into a Pulumi stack, replacing its current state — typically for state migration between backends, state repair, or restoring from backup. The body must be a complete untyped deployment object in the same format returned by the ExportStack endpoint. Returns the imported deployment record including its version,…. Required: org_name, project_name, stack_name.

pulumi_notifications_settings_bulk_update

Update the notification settings for a Pulumi stack, controlling whether notifications are sent on update success or failure. Returns the updated stack metadata (id) including the new notification settings. Required: org_name, project_name, stack_name, notifyUpdateFailure, notifyUpdateSuccess.

list_all_pulumi_outputs

Get the outputs of a Pulumi stack without the rest of its state, as recorded by the stack's most recent completed update. Returns the outputs map (secret values as ciphertext secret objects) and the stack's secretsProviders. Required: org_name, project_name, stack_name.

list_all_pulumi_policygroups

List the policy groups that include a specific stack in Pulumi Cloud. Policy groups define which policy packs are enforced on a set of stacks. Returns policy groups with their name, the stacks they apply to, and the policy packs configured within them. Required: org_name, project_name, stack_name.

list_all_pulumi_policypacks

List the policy packs enforced on a Pulumi Cloud stack through its policy group memberships. Returns each enforced policy pack record: id plus provider-defined attributes. Required: org_name, project_name, stack_name.

get_single_pulumi_preview_summary_by_id

Get a concise summary of a specific preview operation in Pulumi Cloud by update ID. Returns: endTime, resourceCount, result, startTime. Required: org_name, project_name, stack_name, id. Returns 404 if the specified update does not exist.

list_all_pulumi_resources_counts

Get the total number of resources currently managed by a Pulumi stack, based on its most recent update. Lightweight stack-size check. Returns: resourceCount, version. Required: org_name, project_name, stack_name.

create_a_pulumi_transfer

Transfer a Pulumi stack from one organization to another. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, toOrg. The stack must have no updates in progress (409 otherwise), and the requesting user must be a member of both organizations.

list_all_pulumi_updates_latests

Get the most recent update for a Pulumi Cloud stack. Returns the latest update as a generic attributes object — id plus update fields (operation kind, start and end times, result status, resource changes summary, configuration, and environment details) defined by the upstream UpdateInfo schema. Required: org_name, project_name, stack_name. Returns…

list_all_pulumi_latest_previews

List the preview (dry-run) operations associated with the latest stack update version of a Pulumi stack. Returns each preview's update record including its info (kind, result, start/end times), version, requestedBy, and policyPacks. Required: org_name, project_name, stack_name.

list_all_pulumi_latest_timelines

Get the timeline of workflow events (deployment triggers, previews, and the final update operation) culminating in the most recent update of a Pulumi stack. Returns: collatedPullRequest, collatedUpdateEvents, previews, update. Required: org_name, project_name, stack_name. Returns 404 if no update exists.

list_all_pulumi_update_previews

List all preview operations recorded for a specific Pulumi stack update version — multiple previews can exist when a stack is previewed several times before an update is applied. Returns the preview operations as a GetStackUpdatesResponse payload, sorted newest-first by default. Required: org_name, project_name, stack_name, version.

list_all_pulumi_update_timelines

Get the Pulumi Cloud update timeline for a stack update version, covering deployment triggers, previews, and the update operation itself. Returns the GetUpdateTimelineResponse payload; its event fields are not enumerated in the docs. Required: org_name, project_name, stack_name, version.

list_all_pulumi_upstreamreferences

List the stacks the specified Pulumi Cloud stack references as upstream dependencies via StackReference. Returns each referenced stack's organization, project, name, and version. Required: org_name, project_name, stack_name.

list_all_pulumi_users

Get the authenticated Pulumi user's profile information. Returns: avatarUrl, email, githubLogin, hasMFA, id, identities, isAgent, isManagedByMultiOrg, isOrgManaged, name, organizations, potentialOrganizations, registryAdmin, siteAdmin, tokenInfo.

list_all_pulumi_user_pending_emails

Get the latest pending email change for the currently authenticated Pulumi user. Returns the pending email change record; an empty 204 response is returned when no pending email change requests exist.

pulumi_user_pending_emails_bulk_delete

Delete the pending email change for the currently authenticated Pulumi user. Returns an empty 204 response on success. The pending verification cannot be deleted if it is the verification record for the current primary email.

list_all_pulumi_user_pending_invites

List the pending Pulumi Cloud organization invites for the requesting user. Each returned invite includes its id, recipient email, assigned role, status, sentAt timestamp, sentBy sender details, and acceptInviteUrl.

list_all_pulumi_user_stacks

List the Pulumi stacks accessible to the authenticated user, filterable by organization, project, tags, and custom role, with token-based pagination. Returns stack summary records (AppListStacksResponse) whose fields are not enumerated in the upstream docs — name, project, last update status, and resource count are described in prose only. No…

list_all_pulumi_user_tokens

List Pulumi access tokens bound to the authenticated user, including personal access tokens and refresh tokens issued during agent signup (web-session tokens are excluded). Returns: continuationToken, tokens.

create_a_pulumi_user_token

Create a Pulumi personal access token for the authenticated user. Returns: id, tokenValue. Required: description, expires.

delete_a_pulumi_user_token_by_id

Delete a Pulumi personal access token by id; the token is immediately invalidated and can no longer authenticate. Returns an empty 204 response on success. Required: id.

pulumi_user_vcs_bulk_delete

Remove a VCS identity provider (e.g., github, gitlab, bitbucket) from the current Pulumi user's account. Returns the updated user record as id plus content-type-specific attributes. The account must keep more than one identity provider.

list_all_pulumi_vcs_organizations

List the VCS organizations visible to the Pulumi Service for the requesting user. Returns: organizations. Providers the user has no linked identity for are skipped.

create_a_pulumi_vcs_sync

Sync the Pulumi user's profile with their VCS identity provider, refreshing profile details the provider maintains (display name, avatar URL, etc.). Returns the updated user record: id plus the upstream User schema fields under attributes.

list_all_pulumi_user_verified_emails

Check whether the authenticated Pulumi user has a verified email. Returns a boolean result: true when a verified email exists; the API responds with 404 Not Found when the user's email is not verified. Takes no parameters.

list_all_pulumi_change_request_events

List the event log of a Pulumi Cloud change request, including approvals, status changes, and other lifecycle events. Returns events with id plus event-type-specific fields. Required: org_name, change_request_id.

pulumi_change_requests_approve

Approve a Pulumi Cloud change request on behalf of the authenticated user; once the required number of approvals is met the request can be applied. Returns an empty 204 response on success. Required: org_name, change_request_id, revisionNumber.

pulumi_change_requests_close

Close a Pulumi Cloud change request without applying it, discarding the proposed infrastructure changes and marking it as closed. Returns an empty 204 response on success. Required: org_name, change_request_id.

get_single_pulumi_change_request_by_id

Get a single Pulumi Cloud change request by id, including its current status, description, approvals, and the proposed infrastructure changes. Returns: action, createdAt, createdBy, description, entity, id, latestRevisionNumber, orgID, status, gateEvaluation. Required: id, org_name.

list_all_pulumi_change_requests

List Pulumi Cloud change requests for an organization, with pagination and filtering by entity type and entity id. Returns per record: id, status, description, approvals. Required: org_name.

pulumi_change_requests_submit

Submit a draft Pulumi Cloud change request for approval, moving it into the review workflow where it requires the configured number of approvals before it can be applied. Returns an empty 204 response on success. Required: org_name, change_request_id.

update_a_pulumi_change_request_by_id

Update a Pulumi change request's metadata. Currently only the description field can be modified after creation. Returns an empty 204 response on success. Required: id, org_name, description.

list_all_pulumi_stack_activities

List the activity history for a Pulumi Cloud stack, including updates, configuration changes, and other operations. Returns the activity list with each entry's deployment and update details, plus total and itemsPerPage counts. Required: org_name, project_name, stack_name. Max 500 per page.

create_a_pulumi_stack

Create a stack in Pulumi Cloud within an organization and project, creating the project too if it does not exist; the stack name must be unique within the project. Returns the created stack: id, stackName, org_name, project_name, version, tags, activeUpdate, and currentOperation. Required: org_name, project_name, stackName.

delete_a_pulumi_stack_by_id

Delete a stack in Pulumi Cloud. By default the stack must have no resources remaining; pass force=true to delete it even when it still manages resources. Deletion is a soft-delete that hides the stack from normal queries. Returns an empty 204 response on success. Required: id, org_name, project_name.

get_single_pulumi_stack_by_id

Get a single stack in Pulumi Cloud by id and inspect its current state and metadata. Returns: activeUpdate, config, currentOperation, id, orgName, projectName, stackName, tags, version. Required: org_name, project_name, id.

create_a_pulumi_org_hook

Create a Pulumi organization-level webhook that notifies an external service on stack, deployment, drift-detection, or policy-violation events. Returns the created webhook: id, name, payloadUrl, format, filters, active. Defaults: format to raw. Required: org_name, active, displayName, organizationName, payloadUrl.

delete_a_pulumi_org_hook_by_id

Delete a Pulumi organization-level webhook by id, permanently stopping its event notifications. Returns an empty 204 response on success. Required: id and org_name.

get_single_pulumi_org_hook_by_id

Get a Pulumi organization-level webhook by id. Returns: active, displayName, envName, filters, format, groups, name, organizationName, payloadUrl, projectName, secret, stackName, hasSecret, secretCiphertext. Required: id and org_name.

list_all_pulumi_org_hooks

List all webhooks configured at the organization level in Pulumi. Returns each webhook's id, name, payloadUrl, format, active status, and subscribed event filters. Required: org_name.

update_a_pulumi_org_hook_by_id

Update a Pulumi organization-level webhook by id, changing its destination URL, format, active status, event filters, or secret. Returns the updated webhook: id, name, payloadUrl, format, filters, active. Required: id and org_name. The 'pulumi_deployments' format is not valid for organization-level webhooks.

get_single_pulumi_org_by_id

Get a Pulumi organization's details by name. Returns: avatarUrl, githubLogin, name, repos. Required: id.

update_a_pulumi_org_by_id

Update a Pulumi organization's settings, such as the default stack permission level for new members and whether members can create teams. Returns the updated organization metadata: name, displayName, avatarUrl, memberCount, and features. Required: id.

create_a_pulumi_stack_tag

Create a new tag on a Pulumi Cloud stack. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, name, value. Reserved name prefixes 'pulumi:', 'gitHub:' and 'vcs:' belong to built-in tags that Pulumi refreshes from project metadata.

delete_a_pulumi_stack_tag_by_id

Delete a tag from a Pulumi Cloud stack by its name. Returns an empty 204 response on success. Built-in tags managed by Pulumi cannot be deleted. Required: id, org_name, project_name, stack_name.

update_a_pulumi_stack_tag_by_id

Update the value of an existing tag on a Pulumi Cloud stack, identified by the tag name. Returns an empty 204 response on success. Built-in tags cannot be updated. Required: id, org_name, project_name, stack_name.

pulumi_stack_tags_bulk_update

Replace all tags on a Pulumi Cloud stack with a JSON map of tag name-value pairs; existing tags not included are removed. Returns an empty 204 response on success. Required: org_name, project_name, stack_name. Include built-in 'pulumi:', 'gitHub:' and 'vcs:' tags unchanged.

delete_a_pulumi_team_by_id

Delete a team from a Pulumi organization by id. Revokes the team's stack permission grants, removes access granted solely through team membership, and invalidates the team's tokens; the action cannot be undone. Returns an empty 204 response on success. Required: id, org_name.

get_single_pulumi_team_by_id

Get a Pulumi organization team by id. Returns the full team object including name, displayName, description, type, members, and stackPermissions. Required: id, org_name.

list_all_pulumi_teams

List all teams in a Pulumi organization. Returns each team's name, type (Pulumi-managed, GitHub-backed, or GitLab-backed), and member count. Teams are available to organizations on Enterprise and Business Critical editions. Required: org_name.

update_a_pulumi_team_by_id

Update a Pulumi organization team by id: add or remove members (member, memberAction), grant a stack permission (addStackPermission: 101 read, 102 edit, 103 admin), or revoke (removeStack). Returns an empty 204 response on success. Not available to individual organizations. Required: id, org_name.

list_all_pulumi_agent_task_events

List the event stream for a specific Pulumi agent task, including agent messages, tool calls, status changes, and user interactions. Returns: continuationToken, events. Required: org_name, task_id. Page size must be between 1 and 1000.

pulumi_agent_tasks_cancel

Force-cancel a Pulumi agent task: immediately terminates its runtime session and resets the task to idle without notifying the agent runtime. Returns an empty 204 response on success. Required: org_name, task_id, force.

create_a_pulumi_agent_task

Create a Pulumi agent task for an organization by submitting the prompt (the user event message whose type discriminator must be set to "user_message") that initiates it. Returns the created task details including id, name, and createdAt. Required: org_name.

get_single_pulumi_agent_task_by_id

Get a Pulumi agent task by id. Returns the task's metadata including id, name, and createdAt. Required: id, org_name.

list_all_pulumi_agent_tasks

List Pulumi agent tasks for an organization, filterable by status, task type, agent definition, source, and case-insensitive name match, with configurable sorting. Returns task records including id, name, and createdAt. Required: org_name.

update_a_pulumi_agent_task_by_id

Update the settings or metadata of a Pulumi agent task; only the user who created the task can modify it, and changes take effect with the task's next conversation turn. Returns the updated task including id, name, and createdAt. Required: id, org_name.

create_a_pulumi_preview_event

Record a single engine event for a Pulumi stack preview — an individual resource operation or diagnostic message from the CLI. For better performance, send multiple events at once via the batch events endpoint. Returns an empty 200 response on success. Required: org_name, project_name, stack_name, update_id, sequence, timestamp.

list_all_pulumi_preview_events

List the engine events produced during a Pulumi stack preview — individual resource operations and diagnostic messages. Returns: continuationToken, events. Required: org_name, project_name, stack_name, update_id.

get_single_pulumi_preview_update_by_id

Get a specific preview operation for a Pulumi Cloud stack by id. Returns: githubCommitInfo, info, latestVersion, policyPacks, requestedBy, requestedByToken, updateID, version. Returns 404 if the preview does not exist. Required: id, org_name, project_name, stack_name.

pulumi_previews_cancel

Request cancellation of an in-progress Pulumi preview update on a stack. Cancellation is processed asynchronously and the update transitions to a cancelled state. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, update_id.

pulumi_previews_complete

Mark a service-managed Pulumi preview update as complete by submitting its final status. Returns an empty 204 response on success; returns 400 for an unrecognized status and 409 if the update has not started, was cancelled, already timed out, or already completed. Required: org_name, project_name, stack_name, update_id, status.

create_a_pulumi_preview

Create a new preview update for a Pulumi stack — a dry run showing what changes a deploy would make without applying them. Returns the created preview update record, which must subsequently be started via start. Enforces stack update concurrency checks. Required: org_name, project_name, stack_name, config, description, main, metadata, name, options, runtime.

get_single_pulumi_preview_by_id

Get the current status and results of a Pulumi preview update, including whether it is still in progress, succeeded, or failed. Returns the status and results payload; the response fields are not enumerated in the documentation. Required: id, org_name, project_name, stack_name.

pulumi_previews_start

Start execution of a previously created Pulumi preview update. Returns: journalVersion, token, tokenExpiration, version. Required: org_name, project_name, stack_name, update_id. Returns 404 if the update does not exist and 409 if another update is already in progress.

create_a_pulumi_update_event

Record a single engine event sent during a Pulumi stack update. Returns an empty 200 response on success. For better performance, prefer the batch events endpoint when sending multiple events. Required: org_name, project_name, stack_name, update_id, sequence, timestamp.

list_all_pulumi_update_events

List the engine events for a Pulumi stack update. Returns: continuationToken, events. Required: org_name, project_name, stack_name, update_id.

create_a_pulumi_update_log

Append a log entry to a Pulumi stack update's log stream, recording diagnostic messages, status information, and other output generated during the update. Returns an empty 204 response on success. The log entry is sent as a JSON request body. Required: org_name, project_name, stack_name, update_id, fields, kind.

pulumi_updates_cancel

Cancel a service-managed Pulumi update that is currently in progress. Cancellation is processed asynchronously and the update transitions to a cancelled state. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, update_id.

pulumi_updates_complete

Mark a service-managed Pulumi update as complete by reporting its final status. Returns an empty 204 response on success. Fails if the status is unrecognized or the update is not in a completable state. Required: org_name, project_name, stack_name, update_id, status.

create_a_pulumi_update

Create a new standard update (pulumi up) for a Pulumi stack to deploy infrastructure changes. This only creates the update record; the update must subsequently be started before it runs. Returns the created update program response. Required: org_name, project_name, stack_name, config, description, main, metadata, name, options, runtime.

get_single_pulumi_update_by_id

Get the current status and results of a standard (pulumi up) update in Pulumi, including whether it is still in progress, succeeded, or failed. Returns the update results object. Required: id, org_name, project_name, stack_name.

list_all_pulumi_updates

List the update history for a Pulumi stack. Returns the stack's update history entries. Set output-type to switch from the legacy to the paginated response format. Required: org_name, project_name, stack_name.

pulumi_updates_start

Start a previously created standard (pulumi up) update in Pulumi Cloud. Returns a start confirmation with the lease token, its expiration timestamp, journal version, and the update's version number. Required: org_name, project_name, stack_name, update_id. The update must be created first; fails if another update is already in progress on the stack.

list_all_pulumi_deleted_envs

List soft-deleted Pulumi ESC environments in an organization that are still within the retention window and eligible for restoration. Returns each entry's organization, project, name, created, and modified timestamps. Required: org_name.

pulumi_deleted_envs_restore

Restore a previously deleted Pulumi ESC environment in an organization by its project and name. Returns an empty 204 response on success. The environment must still be within the retention window and not yet permanently purged. Required: org_name, name, project, deletionTimestamp.

pulumi_envs_clone

Clone a Pulumi ESC environment into a destination project and/or under a new name — the mechanism for moving or renaming environments, since they cannot be renamed directly. Returns an empty 204 response on success. Required: org_name, project_name, env_id, name.

create_a_pulumi_env

Create a new Pulumi ESC environment in an organization; the environment starts with an empty YAML definition and its name must be unique within the project (alphanumeric characters, hyphens, underscores, and periods only). No content body is returned on success. Required: org_name, name, project.

delete_a_pulumi_env_by_id

Delete a Pulumi ESC environment by id, permanently removing its revision history, tags, and associated configuration. No content body is returned on success. Returns an empty 204 response on success. Required: id, org_name, project_name.

get_single_pulumi_env_by_id

Get a Pulumi ESC environment by id, returning its YAML definition (imports, values, provider configurations, and function invocations) with secrets still in encrypted form. No content body is returned in JSON form; response metadata is carried in the ETag and Pulumi-ESC-Revision headers. Required: id, org_name, project_name.

list_all_pulumi_envs

List Pulumi ESC environments accessible to the authenticated user across all their organizations. Returns paginated entries that include the environment's organization, project, and name plus creation/modification timestamps.

update_a_pulumi_env_by_id

Update a Pulumi ESC environment's YAML definition in Pulumi. Sends the complete environment definition as raw YAML, validates it, and creates a new immutable revision. Returns the revision metadata: etag, revision. Returns 409 if the environment changed since it was last read. Required: id, org_name, project_name, body.

list_all_pulumi_environment_tag_summaries

List all unique environment tag names and their distinct values across every Pulumi ESC environment in an organization. Returns a map of tag names (keys) to lists of their distinct tag values (values). Required: org_name.

create_a_pulumi_environment_tag

Create a user-defined tag on a Pulumi ESC environment. Returns the created tag with its name, value, and audit metadata (created, modified, editorLogin). A tag name that already exists on the environment is rejected. Required: org_name, project_name, env_name, name, value.

delete_a_pulumi_environment_tag_by_id

Delete a user-defined tag from a Pulumi ESC environment, identified by its tag name. Returns an empty 204 response on success. Requires org_name, project_name, env_name, and id (the tag name). Required: id, org_name, project_name, env_name.

get_single_pulumi_environment_tag_by_id

Get a single user-defined tag of a Pulumi ESC environment by its tag name. Returns: created, editorLogin, editorName, modified, name, value. Required: id, org_name, project_name, env_name.

list_all_pulumi_environment_tags

List the user-defined tags of a Pulumi ESC environment. Returns: nextToken, tags. Required: org_name, project_name, env_name.

update_a_pulumi_environment_tag_by_id

Update the value of an existing user-defined tag on a Pulumi ESC environment, identified by its tag name. Returns the updated tag with its name, value, and audit metadata (created, modified, editorLogin). Required: id, org_name, project_name, env_name, currentTag, newTag.

create_a_pulumi_esc_webhook

Create a webhook on a Pulumi ESC environment so an external service is notified of environment events such as updates and opens. Returns the created webhook with name, payloadUrl, format, filters, and active. Returns 409 if a webhook with the same name already exists. Required: org_name, project_name, env_name, active, displayName, organizationName, payloadUrl.

delete_a_pulumi_esc_webhook_by_id

Delete a webhook from a Pulumi ESC environment; the external service will no longer receive notifications for environment events. Returns an empty 204 response on success. Required: id, org_name, project_name, env_name.

get_single_pulumi_esc_webhook_by_id

Get a single webhook configured on a Pulumi ESC environment by id. Returns the webhook's name, payloadUrl, filters, format, and active. Required: id, org_name, project_name, env_name.

list_all_pulumi_esc_webhooks

List all webhooks configured for a Pulumi ESC environment. Each entry includes name, payloadUrl, filters, format, and active. Required: org_name, project_name, env_name.

update_a_pulumi_esc_webhook_by_id

Update an existing webhook on a Pulumi ESC environment, including its destination URL, event filters, format, and active status. Returns the updated webhook with name, payloadUrl, filters, format, and active. Returns 400 if an invalid format is specified. Required: id, org_name, project_name, env_name.

create_a_pulumi_stack_webhook

Create a new webhook for a Pulumi Cloud stack. Returns the created webhook including name, displayName, payloadUrl, format, filters, groups, and active status. A webhook with the same name returns 409. Required: org_name, project_name, stack_name, active, displayName, organizationName, payloadUrl.

delete_a_pulumi_stack_webhook_by_id

Delete a webhook from a Pulumi Cloud stack by id (the webhook's name). Returns an empty 204 response on success. Required: org_name, project_name, stack_name, id.

get_single_pulumi_stack_webhook_by_id

Get a single webhook configured on a Pulumi Cloud stack by id (the webhook's name). Returns the webhook including name, displayName, payloadUrl, format, filters, groups, and active status. Required: org_name, project_name, stack_name, id.

list_all_pulumi_stack_webhooks

List all webhooks configured on a Pulumi Cloud stack. Each webhook includes name, displayName, payloadUrl, format, filters, groups, and active status. Required: org_name, project_name, stack_name.

update_a_pulumi_stack_webhook_by_id

Update an existing webhook's configuration on a Pulumi Cloud stack by id (the webhook's name). Returns the updated webhook including name, displayName, payloadUrl, format, filters, groups, and active status. Required: org_name, project_name, stack_name, id.

list_all_pulumi_audit_logs

List audit log events for a Pulumi organization. Returns: auditLogEvents, continuationToken. Required: org_name.

create_a_pulumi_policy_group

Create a policy group in a Pulumi organization. Returns an empty 204 response on success. Required: org_name, name.

delete_a_pulumi_policy_group_by_id

Delete a policy group from a Pulumi organization by id. Returns an empty 204 response on success. The organization's default policy group cannot be deleted. Required: id, org_name.

get_single_pulumi_policy_group_by_id

Get a Pulumi organization's policy group by id — the id is the policy group's name. Returns: accounts, agentPoolId, appliedPolicyPacks, entityType, isOrgDefault, mode, name, stacks. Required: org_name and id.

list_all_pulumi_policy_groups

List a Pulumi organization's policy groups. Returns each group's id, name, created_at, and attributes covering the applied policy packs and assigned stacks or cloud accounts. Required: org_name.

update_a_pulumi_policy_group_by_id

Update a Pulumi organization's policy group by id (the id is the policy group's name) — rename it or add/remove stacks, policy packs, or Insights accounts. Returns an empty 204 response on success. Required: org_name and id. Default policy groups cannot be renamed; enforcement mode is fixed once created.

list_all_pulumi_issues_filters

Get the available filter options (policy packs, enforcement levels, severity, resource types) for policy issues in a Pulumi organization. Returns: field, values. Required: org_name, field.

list_all_pulumi_policyresults_compliances

Get policy compliance results for a Pulumi Cloud organization grouped by stack, cloud account, or severity to power the compliance dashboard. Returns: columns, continuationToken, rows. Required: org_name, entity.

pulumi_workflows_search

Generate a customized CI/CD starter workflow template for a Pulumi Cloud stack, tailored to the stack's runtime and configuration. Returns 400 if the CI system is not specified or the stack does not have a runtime tag, and 404 if no matching workflow template exists. Required: org_name, project_name, stack_name, ciSystem, enablePathFilters, workingDirectory.

create_a_pulumi_agent_task_response

Send a user response to an ongoing Pulumi Neo agent task, such as a message, confirmation, or cancel event. Returns an empty 202 response on success. Returns 409 if the task already has a pending request that has not completed. Required: org_name, task_id.

create_a_pulumi_change_request_comment

Add a comment to a Pulumi Cloud change request without approving or closing it, so reviewers can share feedback or ask questions before a decision. Returns an empty 204 response on success. Requires org_name, change_request_id, and a JSON comment body. Required: org_name, change_request_id, comment.

create_a_pulumi_stack_rename

Rename a Pulumi Cloud stack identified by org_name, project_name, and stack_name, optionally moving it to a different project. Returns: updateId. Fails if another update is currently in progress on the stack. Required: org_name, project_name, stack_name, newName, newProject.

list_all_pulumi_stack_deployments

List Pulumi Deployments executions for a stack. Returns deployments with id, status, version, created, modified, requestedBy and pulumiOperation. Required: org_name, project_name, stack_name.

create_a_pulumi_stack_deployment

Start a Pulumi Deployments execution (update, preview, refresh or destroy) for a stack, using the stack deployment settings when inheritSettings is true. Runs on Pulumi-hosted or self-hosted agents and consumes deployment minutes. Returns id, version and consoleUrl. Required: org_name, project_name, stack_name, operation.

get_single_pulumi_stack_deployment_by_id

Get a Pulumi Deployments execution by id. Returns status, created, modified, version, jobs (with steps), configuration and requestedBy. Required: org_name, project_name, stack_name, id.

pulumi_stack_deployments_cancel

Cancel an in-progress or queued Pulumi Deployments execution. Returns an empty response on success. Required: org_name, project_name, stack_name, deployment_id.

list_all_pulumi_stack_deployment_logs

Get execution logs for a Pulumi Deployments run, either streamed with continuationToken or for a specific job and step. Returns log lines and a nextToken. Required: org_name, project_name, stack_name, deployment_id.