---
title: Pulumi API Integration on Truto
slug: pulumi
category: Application Development
canonical: "https://truto.one/integrations/detail/pulumi/"
---

# Pulumi API Integration on Truto



**Category:** Application Development  
**Status:** Beta

## MCP-ready AI tools

Truto exposes 381 tools for Pulumi that AI agents can call directly.

- **list_all_pulumi_agents_signups** — Get a proof-of-work challenge for Pulumi agent signup. Returns the challengeID and the challengeData the proof of work is computed over. The challenge expires after a short window if not consumed.
- **create_a_pulumi_agents_signup** — Create a new Pulumi Cloud account programmatically for an agent. Returns: accessToken, accessTokenValidUntil, claimToken, claimTokenValidUntil, userInfo. The account is created in a pre-claim state; the human takes ownership via the returned claim URL. Required: challengeID, challengeResult.
- **get_single_pulumi_signup_validate_by_id** — Validate an agent signup claim token in Pulumi Cloud. Verifies the token is still valid and returns the agent claim response (AgentClaimResponse) — details about the agent and the resources it created; upstream docs do not enumerate its fields. 404 if unknown, expired, or canceled. Required: id.
- **create_a_pulumi_agent_claim** — Preview (dryRun=true) or commit a Pulumi agent claim for an organization. On commit the agent's stacks transfer to the destination organization and the agent's organization and access token are soft-deleted; conflicts or failures are returned and block the change. Returns: agent, conflicts, failures, and 3 more. Required: org_name, claimToken.
- **list_all_pulumi_claim_status** — Fetch details about recent Pulumi agent claims for an organization. Returns a JSON claim status object whose fields follow the upstream AgentClaimsStatus schema. Required: org_name.
- **list_all_pulumi_capabilities** — List the set of capabilities that the Pulumi Cloud service supports. Requires no parameters. Returns: capability, configuration, version.
- **list_all_pulumi_change_gates** — List change gates in a Pulumi Cloud organization, currently for a single entity. Returns matching change gate objects with id and content-type-specific attributes. Required: org_name. Supports optional entityType and qualifiedName filters.
- **create_a_pulumi_change_gate** — Create a change gate in a Pulumi Cloud organization that enforces approval requirements before changes can be applied to a protected entity. Returns the created change gate as an opaque object with id and content-type-specific attributes. Required: org_name, enabled, name, rule, target.
- **get_single_pulumi_change_gate_by_id** — Get a single change gate by id in a Pulumi Cloud organization, including its approval requirements and the entity it protects. Returns the change gate as an opaque object with id and content-type-specific attributes. Required: id, org_name.
- **update_a_pulumi_change_gate_by_id** — Update the configuration of an existing change gate, such as its approval requirements or protected entity, in a Pulumi Cloud organization. Returns the updated change gate as an opaque object with id and content-type-specific attributes. Required: id, org_name, enabled, name, rule, target.
- **delete_a_pulumi_change_gate_by_id** — Delete a change gate by id, removing the approval requirement from the protected entity so changes no longer require approval. Returns an empty 204 response on success. Required: id, org_name.
- **create_a_pulumi_apply** — Apply an approved Pulumi change request to execute its proposed infrastructure changes. Returns the apply result: id and schema-specific attributes per the upstream ChangeRequestApplyResult definition. The change request must have the required number of approvals; a conflict returns…. Required: org_name, change_request_id.
- **list_all_pulumi_cli_versions** — Get version information about the Pulumi CLI. Returns: latestDevVersion, latestVersion, oldestWithoutWarning. Takes no required parameters.
- **list_all_pulumi_org_integrations** — List a summary of all VCS integrations (GitHub, GitLab, Azure DevOps, Custom) configured for a Pulumi organization. Returns: avatarUrl, baseUrl, hasIndividualAccess, host, id, name, vcsProvider. Required: org_name.
- **list_all_pulumi_integrations_azure_devops** — List the Azure DevOps integrations configured for a Pulumi organization. Returns one integration record per item, each including its id; field-level detail beyond the id is not enumerated in the available documentation. Required: org_name.
- **create_a_pulumi_integrations_azure_devop** — Create an Azure DevOps integration for a Pulumi organization. Returns an empty 204 response on success. Required: org_name. The request body must specify the Azure DevOps organization and project; 409 is returned if an integration already exists for that project.
- **get_single_pulumi_integrations_azure_devop_by_id** — Get a single Azure DevOps integration by id from a Pulumi organization. Returns the integration record including its id; field-level detail beyond the id is not enumerated in the available documentation. Required: id, org_name.
- **update_a_pulumi_integrations_azure_devop_by_id** — Update an existing Azure DevOps integration's settings by id, including its Azure DevOps organization, project, or authentication configuration. Returns an empty 204 response on success. Required: id, org_name.
- **delete_a_pulumi_integrations_azure_devop_by_id** — Delete a specific Azure DevOps integration from a Pulumi organization by id. Returns an empty 204 response on success. Required: id, org_name.
- **list_all_pulumi_azure_devops_access_status** — Get the current user's Azure DevOps access status for a Pulumi organization, including whether they have a valid OAuth token. Returns: availableOrgs, hasIntegration, hasUserToken. Required: org_name.
- **list_all_pulumi_setup_organizations** — List the Azure DevOps organizations available to the current Pulumi user for VCS integration setup. Returns: accountUrl, hasRequiredPermissions, id, name. Requires an active Azure DevOps OAuth token. Required: org_name.
- **list_all_pulumi_organization_projects** — List the Azure DevOps projects in an Azure DevOps organization that are available to the current user in Pulumi. Returns: id, name. Required: org_name, ado_org_name.
- **list_all_pulumi_integrations_bitbuckets** — List the BitBucket integrations configured for a Pulumi organization. Returns: authType, authUser, avatarUrl, disableDetailedDiff, disableNeoSummaries, id, installed, valid, and 4 more. Entries carry the linked BitBucket workspace metadata and validity status, as typed by the upstream ListBitBucketIntegrationsResponse schema. Required: org_name.
- **create_a_pulumi_integrations_bitbucket** — Create a BitBucket integration for a Pulumi organization. Requires a BitBucket workspace UUID and optionally configures authentication via the user's BitBucket OAuth token or a workspace access token / PAT. Returns an empty 204 response on success; the call fails if an integration already exists for the workspace. Required: org_name, workspaceSlug, workspaceUuid.
- **get_single_pulumi_integrations_bitbucket_by_id** — Get a single BitBucket integration by id. Returns: id, installed, valid, and 9 more. The record's full details — the linked BitBucket workspace, authentication configuration, and validity status — are typed by the upstream BitBucketIntegrationDetails schema, which the published reference does not enumerate field-by-field. Required: id, org_name.
- **update_a_pulumi_integrations_bitbucket_by_id** — Update a BitBucket integration's settings, such as PR comment preferences and AI summary options. Returns an empty 204 response on success. Required: id, org_name.
- **delete_a_pulumi_integrations_bitbucket_by_id** — Delete a BitBucket integration by id, removing the integration and cleaning up its associated webhooks and access tokens. Returns an empty 204 response on success. Required: id, org_name.
- **list_all_pulumi_bitbucket_access_status** — Get a user's BitBucket access status in Pulumi for an organization, including whether they have a valid BitBucket OAuth token and which BitBucket workspaces are available for new integrations. Returns the BitBucketAccessStatusResponse object; the API reference does not enumerate its fields. Required: org_name.
- **list_all_pulumi_integrations_customs** — List all custom VCS integrations configured for a Pulumi organization. Returns each integration's configuration, webhook URL, and configured repositories; webhook secrets are not included in list responses. Required: org_name.
- **create_a_pulumi_integrations_custom** — Create a custom VCS integration connecting a self-hosted or third-party VCS (e.g. Gitea, Forgejo, Bitbucket Server) to Pulumi Deployments. Returns the created integration including its configuration, webhook URL, and one-time HMAC secret for signature verification. Required: org_name, baseUrl, environment, name.
- **get_single_pulumi_integrations_custom_by_id** — Get a specific custom VCS integration by id. Returns the integration details including its configuration, webhook URL, and configured repositories; the webhook secret is not included (it is returned only at creation time or when regenerated). Required: id, org_name.
- **update_a_pulumi_integrations_custom_by_id** — Update a custom VCS integration's settings by id; only provided fields are modified. Returns the updated integration (configuration, webhook URL, repositories). Set regenerateWebhookSecret to true to rotate the webhook HMAC secret, invalidating the previous secret immediately. Required: id, org_name.
- **delete_a_pulumi_integrations_custom_by_id** — Delete a custom VCS integration by id, permanently removing the integration, its webhook endpoint, and all configured repository associations. Returns an empty 204 response on success. Required: id, org_name.
- **create_a_pulumi_repo** — Add a repository to a custom VCS integration in Pulumi Cloud. Returns an empty 204 response on success; a duplicate repository name is rejected. Required: org_name, integration_id, name.
- **list_all_pulumi_repos** — List repositories available through a Pulumi Cloud VCS integration. Returns the collection of repositories the integration exposes. Required: org_name, provider, integration_id.
- **pulumi_repos_bulk_delete** — Remove a repository from a custom VCS integration in Pulumi Cloud; the repository is identified by the name provided in the request body. Returns an empty 204 response on success. Required: org_name, integration_id, name.
- **list_all_pulumi_integrations_githubs** — List the GitHub App integrations configured for a Pulumi organization. Returns: installationUrl, integrations. Required: org_name.
- **create_a_pulumi_integrations_github** — Start GitHub App setup for a Pulumi organization. Returns the setup response carrying the installation URL and state for completing the GitHub App installation flow. Required: org_name.
- **get_single_pulumi_integrations_github_by_id** — Get a single GitHub App integration by id in a Pulumi organization. Returns: accountID, accountName, avatarUrl, created, disableCodeAccessForReviews, disableDetailedDiff, disableDraftPRComments, disableNeoSummaries, disablePRComments, ghUrls, hasContentsPermission, hasMembersPermission, id, individualAuthEnabled, and 4 more. Required: org_name, id.
- **update_a_pulumi_integrations_github_by_id** — Update a GitHub App integration's settings in a Pulumi organization. Returns an empty 204 response on success. Required: id, org_name.
- **delete_a_pulumi_integrations_github_by_id** — Delete a GitHub App integration from a Pulumi organization. Returns an empty 204 response on success. Required: org_name, id.
- **list_all_pulumi_integrations_github_enterprises** — List all GitHub Enterprise Server integrations for a Pulumi organization; returns only self-hosted GitHub App installations. Returns: installationUrl, integrations. Required: org_name.
- **get_single_pulumi_integrations_github_enterprise_by_id** — Get a specific GitHub Enterprise Server integration in a Pulumi organization by id. Returns: accountID, accountName, avatarUrl, created, disableCodeAccessForReviews, disableDetailedDiff, disableDraftPRComments, disableNeoSummaries, disablePRComments, ghUrls, hasContentsPermission, hasMembersPermission, id, and 5 more. Required: id, org_name.
- **update_a_pulumi_integrations_github_enterprise_by_id** — Update the settings of a GitHub Enterprise Server integration in a Pulumi organization by id. Returns an empty 204 response on success. Required: id, org_name.
- **delete_a_pulumi_integrations_github_enterprise_by_id** — Delete a GitHub Enterprise Server integration from a Pulumi organization by id. Returns an empty 204 response on success. Required: id, org_name.
- **get_single_pulumi_github_enterprise_user_auth_by_id** — Get the GitHub Enterprise identity the current Pulumi Cloud user has linked for an organization's GitHub Enterprise integration's host. Returns: connectedAt, githubId, login. Returns 404 if the user has not linked an identity on that host. Required: id, org_name.
- **pulumi_github_enterprise_user_auths_bulk_delete** — Disconnect the current Pulumi Cloud user's linked GitHub Enterprise identity for an organization's GitHub Enterprise integration's host by deleting the stored user access token and identity rows. Returns an empty 204 response on success. Idempotent — succeeds even if no identity is currently linked. Required: org_name, integration_id.
- **get_single_pulumi_user_auth_authorize_by_id** — Get the GitHub Enterprise OAuth authorization URL that links the current user's identity for a Pulumi organization's GitHub Enterprise integration. Returns: authorizeUrl. Required: org_name, id.
- **list_all_pulumi_user_auth_members** — List the github.com logins of organization members who have linked a GitHub Enterprise identity on the given integration's host. Returns: linkedLogins. Required: org_name, integration_id.
- **list_all_pulumi_github_access_status** — Get the current user's GitHub OAuth access status for a Pulumi Cloud organization. Returns the access-status record with id and attributes describing the user's GitHub OAuth state. Required: org_name.
- **create_a_pulumi_github_claim** — Claim an existing, unlinked Pulumi GitHub App installation and link it to the organization. Returns the claimed integration details (id plus attributes). Idempotent when already linked; fails if the installation is linked to a different organization. Required: org_name, installationId.
- **list_all_pulumi_github_claimables** — List the Pulumi GitHub App installations that are not linked to any organization and can be claimed for this one. Returns: installations. Required: org_name.
- **list_all_pulumi_integrations_gitlabs** — List the GitLab integrations configured for a Pulumi organization, including their validity status and linked group metadata. Returns per-integration records with id, created_at, updated_at. Required: org_name.
- **create_a_pulumi_integrations_gitlab** — Create a GitLab integration for a Pulumi organization. Returns an empty 204 response on success. Requires a GitLab group ID and org_name; returns 409 if an integration already exists for the specified group. Required: org_name, gitLabGroupId.
- **get_single_pulumi_integrations_gitlab_by_id** — Get a specific GitLab integration configured for a Pulumi organization by its integration id. Returns: authUser, avatarUrl, disableDetailedDiff, disableNeoSummaries, disablePRComments, gitLabGroupId, gitLabOrg, groupAccessTokenExpiration, groupName, groupPath, id, installed, valid. Required: id, org_name.
- **update_a_pulumi_integrations_gitlab_by_id** — Update a GitLab integration's settings, such as PR comment preferences and AI summary options. Returns an empty 204 response on success. Required: id, org_name.
- **delete_a_pulumi_integrations_gitlab_by_id** — Delete a GitLab integration from a Pulumi organization, cleaning up its associated webhooks, access tokens, and group tokens. Returns an empty 204 response on success. Required: id, org_name.
- **list_all_pulumi_gitlab_access_status** — Get the GitLab access status for a Pulumi Cloud organization. Returns the access status payload covering OAuth token validity, existing integrations, and available GitLab groups for new integrations. Required: org_name.
- **list_all_pulumi_repos_destinations** — List Pulumi VCS repo destinations: repositories where the authenticated user can create new repos from templates via the integration. Returns: nextPageToken, repos. provider accepts github, gitlab, bitbucket, azure_devops, custom, or github_enterprise. Required: org_name, provider, integration_id.
- **list_all_pulumi_repo_branches** — List the branches of a repository through a Pulumi Cloud VCS integration. Returns the ListVCSBranchesResponse object with upstream-defined fields; the published docs do not enumerate the response shape. Required: org_name, provider, integration_id, repo_id.
- **list_all_pulumi_member_stacks** — List a Pulumi organization member's effective permissions for a stack, covering access inherited from the default role, team memberships, and explicitly assigned grants. Returns the member's access details (ListMemberStackPermissionsResponse). Required: org_name, user_login, project_name, stack_name.
- **list_all_pulumi_neo_member_usage_caps** — List per-member Neo usage caps in Pulumi. Returns every organization member with their per-member monthly Neo usage cap, month-to-date Neo spend, and effective limit (the smaller of the per-member and org-level caps); caps are denominated in cents. Required: org_name.
- **update_a_pulumi_neo_member_usage_cap_by_id** — Create or replace a single organization member's monthly Neo usage cap in Pulumi with an UpdateNeoMemberUsageCapRequest JSON body; the cap must be at least $10/month and is denominated in cents. Returns the cap record including updatedAt. Required: id, org_name, capCents.
- **delete_a_pulumi_neo_member_usage_cap_by_id** — Remove a single organization member's monthly Neo usage cap in Pulumi, returning the member to only the org-level cap (if any). The operation is idempotent — deleting when no cap is set Returns an empty 204 response on success. Returns an empty 204 response on success. Required: id, org_name.
- **pulumi_org_stacks_search** — Search an organization's stacks in Pulumi, returning a combined view of IaC-managed stacks and discovered stacks. Supports pagination, sorting, and filtering via the grid request body. Returns the ListOrganizationProjectsResponsev3 result set (Pulumi does not enumerate its fields). Required: org_name, filterModel, groupKeys, rowGroupCols, sortModel, valueCols.
- **list_all_pulumi_overviews** — Get the aggregated overview for a Pulumi Cloud stack — its current state, recent activity, resource counts, and configuration combined into a single response. Returns the stack overview object (StackOverviewResponse); the upstream docs reference this schema by name only and do not enumerate its fields. Required: org_name, project_name, stack_name.
- **list_all_pulumi_latest_summaries** — Get a human-readable summary of the most recent update to a Pulumi Cloud stack, with a tree view of resource changes. Returns a console update summary object with id and schema-specific attributes. Fails with 404 if the stack has no updates. Required: org_name, project_name, stack_name.
- **get_single_pulumi_update_summary_by_id** — Get a human-readable summary of a specific Pulumi Cloud update by id, formatted like the CLI's 'pulumi up' output with a tree view of resource changes, create/update/delete counts, and the overall result. Returns the pre-rendered summary object; upstream does not document its field-level structure. Required: id, org_name, project_name, stack_name.
- **list_all_pulumi_update_summaries** — Get a concise summary of a specific Pulumi Cloud stack update by version number — the lighter-weight alternative to the full update-detail endpoint. Returns a summary object carrying the update kind, result status, start and end times, and resource change counts; its field-level structure is not documented upstream. Required: org_name, project_name, stack_name, version.
- **list_all_pulumi_deployments_executors** — Download the Pulumi Deployments executor binary for Linux/AMD64 - the component that runs inside a deployment container and executes Pulumi operations. Returns the raw binary as a stream with no structured fields. Intended for Pulumi-managed deployment runners.
- **list_all_pulumi_deployments_polls** — Poll the Pulumi Deployments queue for the next available deployment job to execute. Returns the deployment's workflow definition object when work is available, or an empty 204 response on success when the queue is empty; agents should poll this endpoint repeatedly. Requires no parameters.
- **get_single_pulumi_deployment_status_by_id** — Get the current execution status of a Pulumi Deployments run by id, to check whether the deployment is still active. Returns a JobStatus string: not-started, accepted, running, failed, succeeded, or skipped; succeeded, failed, and skipped are terminal. Required: id.
- **create_a_pulumi_aws_setup** — Set up AWS infrastructure for a Pulumi Cloud ESC organization using provided static AWS credentials, sending an AWSSetupRequest JSON body. Returns the CloudSetupResult object; the upstream docs do not enumerate its fields. Required: org_name, accessKeyId, oidcRoleName, policyArn, secretAccessKey, sessionToken.
- **list_all_pulumi_sso_accounts** — List the AWS accounts accessible with a Pulumi ESC CloudSetup AWS SSO session in an organization. Returns the ListCloudAccountsResponse payload of AWS accounts; the upstream docs enumerate no field-level shape for it. Required: org_name.
- **create_a_pulumi_sso_initiate** — Initiate the AWS SSO setup flow for a Pulumi Cloud organization. Returns the AWSSSOInitiateResponse JSON payload for a successfully initiated flow; the source references this schema by name without enumerating its fields. Required: org_name, region, startUrl.
- **create_a_pulumi_sso_setup** — Set up AWS infrastructure and ESC environments in Pulumi using AWS SSO for an organization. Returns a CloudSetupResult object; the Pulumi Cloud REST API documents this response only by type name and does not enumerate its fields. Required: org_name, accountId, accountRoleName, oidcRoleName, policyArn, region, sessionId.
- **list_all_pulumi_azure_accounts** — List the Azure subscriptions in Pulumi Cloud that are accessible with the provided ARM session. Returns the list of accessible subscriptions (ListCloudAccountsResponse); the upstream reference does not expose its field-level shape. Required: org_name.
- **create_a_pulumi_azure_setup** — Set up Azure infrastructure and ESC environments for a Pulumi organization using OAuth credentials. Returns the upstream CloudSetupResult object on success; the Pulumi Cloud REST API documentation does not enumerate its fields. Required: org_name, armSessionId, azureEnvironmentInfos, graphSessionId.
- **list_all_pulumi_gcp_accounts** — List the GCP projects accessible with the provided OAuth session in Pulumi Cloud. Returns the ListCloudAccountsResponse payload of discovered accounts; system-generated (sys- prefixed) and pending-deletion projects are excluded. Required: org_name.
- **create_a_pulumi_gcp_setup** — Set up GCP infrastructure for a Pulumi organization using OAuth credentials. Returns the setup result object; its fields are not enumerated in the available documentation. Required: org_name, gcpEnvironmentInfo, oauthSessionId.
- **list_all_pulumi_context_schemas** — Get the JSON Schema of the Pulumi ESC built-in `context` object — the object environments interpolate as ${context...}. Takes no parameters. Returns the raw JSON Schema document describing the available context fields; its shape is invariant across callers and environments.
- **create_a_pulumi_decrypt_secret** — Decrypt encrypted secret values in a Pulumi ESC environment definition. Returns the same definition with fn::secret values decrypted to plaintext (content-type-specific fields). Returns 413 if the content exceeds the maximum allowed size. Required: org_name, project_name, env_name, ciphertexts.
- **create_a_pulumi_draft** — Create a new draft change request proposing changes to a Pulumi ESC environment as part of the approvals workflow. Returns a ChangeRequestRef with the new draft's id. Requires the Approvals feature to be enabled for the organization. Required: org_name, project_name, env_name.
- **get_single_pulumi_draft_by_id** — Get the YAML definition of a draft change request for a Pulumi ESC environment. Returns the draft's environment definition as raw YAML (application/x-yaml). Required: id, org_name, project_name, env_name.
- **update_a_pulumi_draft_by_id** — Update the YAML definition of a draft change request for a Pulumi ESC environment. Returns a ChangeRequestRef with the draft's id; the body carries the updated YAML. Requires the Approvals feature to be enabled for the organization. Required: id, org_name, project_name, env_name.
- **create_a_pulumi_draft_open** — Open a draft of a Pulumi ESC environment for a change request, resolving all dynamic values, provider integrations, and secrets. Returns the open session ID (id) for subsequent reads. Requires the Approvals feature. Required: org_name, project_name, env_name, change_request_id.
- **create_a_pulumi_encrypt_secret** — Encrypt plaintext secret values in a Pulumi ESC environment definition. Returns the same definition with those values encrypted using the environment's encryption key (content-type-specific fields mirroring the submitted definition). Required: org_name, project_name, env_name, plaintexts.
- **list_all_pulumi_referrers** — List entities that reference a Pulumi ESC environment — other environments that import it and Pulumi stacks that use it in their configuration. Returns a paginated list of referrer records (the Pulumi REST API reference does not enumerate the per-referrer fields). Required: org_name, project_name, env_name. count accepts 1-500.
- **create_a_pulumi_rotate** — Rotate the secrets of a Pulumi ESC environment: evaluates all fn::rotate declarations and rotates the corresponding secrets in their external systems. Returns: diagnostics, id, secretRotationEvent. Requires the secret rotation feature to be enabled; returns 409 if the…. Required: org_name, project_name, env_name, paths.
- **list_all_pulumi_rotate_histories** — List a Pulumi ESC environment's secret rotation history — one entry per rotation of fn::rotate secrets. Returns the rotation-history document; the upstream reference does not enumerate its fields. Requires the secret rotation feature to be enabled for the organization. Required: org_name, project_name, env_name.
- **list_all_pulumi_settings** — Get the current settings for a Pulumi ESC environment, including whether deletion protection is enabled. Returns: deletionProtected. Required: org_name, project_name, env_name.
- **pulumi_settings_bulk_update** — Update the settings of a Pulumi ESC environment using a partial patch that currently supports toggling deletion protection; omitted fields retain their current values. Required: org_name, project_name, env_name.
- **list_all_pulumi_esc_providers** — List all available Pulumi ESC providers — integrations that retrieve configuration and secrets from external sources (AWS, Azure, Google Cloud, HashiCorp Vault, 1Password) via fn::open in environment definitions. Returns the provider list response payload; the API reference does not enumerate its fields.
- **list_all_pulumi_esc_rotators** — List all available Pulumi ESC secret rotators — integrations that automatically rotate secrets in external systems via the fn::rotate function in environment definitions. Returns the ListRotatorsResponse payload; upstream docs do not document its individual fields. Optionally filter by organization using the orgName query parameter.
- **list_all_pulumi_rotator_schemas** — Get the JSON schema for a Pulumi ESC secret rotator by name. Returns a rotator-specific JSON Schema document describing the rotator's input parameters, output structure, and configuration options; fields vary per rotator. Required: rotator_name.
- **list_all_pulumi_graph_schemas** — Get the Pulumi Insights graph query schema as JSON, describing the node types, edge types, field vocabularies, and engine limits graph queries support. Returns: edgeTypes, limits, metricOps, nodeTypes, schemaVersion. Pass 'Accept: text/markdown' for a Markdown guide; running graph queries requires entitlement.
- **create_a_pulumi_graph_query** — Execute a graph selection query over a Pulumi organization's resource graph. Returns the GraphQueryResponse — either the matching subgraph or flat aggregation buckets, trimmed to the caller's visible stacks and accounts — with field-level shape defined by the graph query schema. Required: org_name, anchor.
- **create_a_pulumi_oauth_token** — Exchange a credential for a Pulumi access token via grant_type — either a token exchange (send audience, subject_token, subject_token_type, requested_token_type) or a refresh-token grant (send refresh_token). Returns: access_token, expires_in, issued_token_type, refresh_token, scope, token_type, x-originalParamName.
- **list_all_pulumi_openapi_pulumi_specs** — Get the OpenAPI v3 specification for the Pulumi Cloud REST API service. Returns the complete specification document as a single JSON object; its fields follow the OpenAPI v3 standard and are not enumerated per-field. Takes no parameters.
- **list_all_pulumi_org_agent_pools** — List all agent pools configured for a Pulumi organization; each pool enables self-hosted deployment agents to run Pulumi Deployments on your own infrastructure. Returns: agentPools, defaultAgentPoolID. Required: org_name.
- **create_a_pulumi_org_agent_pool** — Create an agent pool for a Pulumi organization to run self-hosted deployment agents on your own infrastructure. Returns: id, tokenValue. Required: org_name, description, name.
- **get_single_pulumi_org_agent_pool_by_id** — Get a single Pulumi agent pool by id. Returns: agents, created, description, id, name. Required: id, org_name.
- **update_a_pulumi_org_agent_pool_by_id** — Update a Pulumi agent pool's configuration (such as its name); only provided fields are updated and omitted fields remain unchanged. Returns: description, name. Required: id, org_name.
- **delete_a_pulumi_org_agent_pool_by_id** — Delete a Pulumi agent pool by id. Deletion fails while any stack's deployment settings reference the pool unless force is set to true; force-deleting makes affected stacks fall back to Pulumi-managed infrastructure. Returns an empty 204 response on success. Required: id, org_name.
- **list_all_pulumi_assignments_lists** — List entity assignments in a Pulumi organization. Returns the EntityAssignmentsResponse (id, attributes): every principal (users and teams) granted a permission set on the entity, plus the permission sets available for assignment on its type. Required: org_name, context, id.
- **update_a_pulumi_assignments_update_by_id** — Grant, change, or revoke a user's direct assignment on an entity in Pulumi. Sending a permission set grants or replaces the user's grant on the entity; omitting it revokes the existing grant. Returns the UpdateEntityAssignmentResponse confirmation. Required: org_name, context, id, userId.
- **list_all_pulumi_auditlogs_event_types** — List the catalog of audit log event types for a Pulumi organization. Returns the eventTypes catalog, each entry carrying event, displayName, description, authenticationFailure, requiresOrgAdmin, and requiresStackAdmin. Not paginated; sorted by event identifier. Required: org_name.
- **list_all_pulumi_export_configs** — Get the organization's audit log export configuration in Pulumi. Returns the audit log export settings object with vendor-defined configuration fields, or 404 if the organization has not configured audit log export. Required: org_name.
- **update_a_pulumi_export_config_by_id** — Create or update the organization's automated audit log export configuration in Pulumi, delivering audit events to an S3 bucket for retention and SIEM integration via an IAM role. Returns an empty 204 response on success. Only available on Business Critical edition. Required: org_name, newEnabled, newS3Configuration.
- **pulumi_export_configs_bulk_delete** — Delete the organization's audit log export configuration in Pulumi. Returns an empty 204 response on success. Required: org_name. Removal is allowed even if the organization no longer has access to the feature.
- **create_a_pulumi_config_force** — Force an audit log export for a Pulumi organization from a user-supplied timestamp to backfill data missed during an outage or permissions issue. Returns the AuditLogExportResult: id plus an attributes object whose schema-specific fields are defined upstream. Required: org_name.
- **create_a_pulumi_config_test** — Test a Pulumi organization's audit log export configuration: checks whether the provided S3 export configuration (AuditLogsExportS3Config) can successfully write data. Returns the audit log export test result (AuditLogExportResult; fields not enumerated in the docs). Fails if audit log export is not available for the…. Required: org_name, iamRoleArn, s3BucketName.
- **list_all_pulumi_auditlogs_reader_kinds** — Get the Pulumi audit logs reader kind for an organization, which indicates whether audit logs are being read from MySQL or DynamoDB. Returns the reader kind as a plain string. Required: org_name.
- **get_single_pulumi_policies_oidcissuer_by_id** — Get the authentication policy associated with a specific OIDC issuer registration in a Pulumi organization. Returns: created, id, modified, policies, version. Required: id, org_name.
- **update_a_pulumi_auth_policy_by_id** — Update an authentication policy for a Pulumi organization, replacing how its OIDC tokens are validated and what access they grant. Returns the updated policy: id and policies (decision, tokenType, teamName, userLogin, runnerID, authorizedPermissions, rules). Requires org_name, org_name, policyId, id, and a non-empty policies array. Required: id, org_name, policies.
- **create_a_pulumi_bulk_transfer_stack** — Transfer all active stacks from one Pulumi organization to another, skipping deleted stacks; the source org is locked read-only until the transfer completes. Returns a plain string response body. Takes a JSON request body (TransferAllStacksRequest). Limited to organizations with at most 100 stacks. Required: org_name, fromOrg, toOrg.
- **list_all_pulumi_org_cmks** — List all customer managed keys (CMKs) configured for a Pulumi Cloud organization, including their key identifiers, cloud provider details, enabled status, and which key is the default for new stacks. Returns key records as id plus attributes. Required: org_name.
- **create_a_pulumi_org_cmk** — Create a customer managed key (CMK) for a Pulumi Cloud organization so secrets can be encrypted with the organization's own cloud provider key (e.g., an AWS KMS key). Returns the created key record as id plus attributes following the upstream CustomerManagedKey schema. Required: org_name, keyType, name.
- **pulumi_org_cmks_disable** — Disable a customer managed key for a Pulumi Cloud organization so it can no longer encrypt new secrets, while existing secrets encrypted with the key remain accessible. Returns an empty 200 response on success. Required: org_name, key_id, destID.
- **create_a_pulumi_cmk_disable** — Disable all customer managed keys (CMK) for a Pulumi organization, reverting secret encryption for new stacks to default Pulumi-managed encryption. Returns an empty 200 OK response on success. Required: org_name.
- **list_all_pulumi_cmk_migrations** — List all key encryption key (KEK) migrations for a Pulumi Cloud organization, which track re-encryption of secrets during customer managed key rotation. Returns: id, state. Required: org_name.
- **create_a_pulumi_migration_retry** — Retry failed key encryption key (KEK) migrations for a Pulumi organization. Re-attempts KEK migrations that failed due to transient errors while re-encrypting secrets during customer managed key rotation, without restarting the whole process. Returns an empty 200 response on success. Required: org_name.
- **create_a_pulumi_coherence_window_subgroup** — Create a subgroup of a Pulumi Cloud stack update coherence window for a set of stacks that will be updated together. The JSON body carries the number of stacks that will take part (it must be positive). Returns: id. Required: org_name, window_id, size.
- **delete_a_pulumi_coherence_window_subgroup_by_id** — Close a Pulumi Cloud coherence window subgroup by id so that no further update may join it. Returns an empty 204 response on success. Required: id, org_name, window_id.
- **list_all_pulumi_org_deployments** — List all Pulumi Deployments executions across an organization, filtered to stacks the requesting user can access. Returns: deployments, itemsPerPage, total. Supports sort and asc; results default to descending order. Required: org_name.
- **list_all_pulumi_deployments_summaries** — Get a Pulumi Deployments compute usage summary (deployment minutes) for an organization, bucketed by time granularity. Returns a summary record with id and attributes (aggregated per-bucket usage). Hourly is limited to a 2-day lookback. Required: org_name, granularity.
- **list_all_pulumi_deployments_usagereports** — List aggregated deployment usage records for a Pulumi Cloud organization for self-reported deployment consumption and billing reconciliation. Returns an array of usage records with vendor-defined UsageRecord fields; lookbackDays controls how far back records are retrieved. Required: org_name.
- **list_all_pulumi_discovered_resources_summaries** — Get the discovered-resource usage summary for a Pulumi organization over a lookback window. Returns: summary, tagKeys. lookbackDays and lookbackStart are optional but mutually exclusive — supply exactly one; hourly is limited to a 2-day lookback. Required: org_name, granularity.
- **list_all_pulumi_insights_scans_summaries** — Get a summary of Insights scan usage for a Pulumi Cloud organization, grouped by the specified time granularity. Returns a resource-count summary object on success (schema GetResourceCountSummaryResponse; field shape not detailed in the API docs), or an empty 204 No Content response when no usage data exists. Required: org_name, granularity.
- **list_all_pulumi_org_invites** — List all pending invitations for a Pulumi organization; each pending invite reserves a seat in the organization's seat limit. Returns each invite's id, email, role, roleId, sentBy, and sentAt. Required: org_name.
- **get_single_pulumi_org_invite_by_id** — Get basic metadata for a Pulumi organization by validating an active invite ID — a reasonably secure way for non-members who know both the org name and the invite ID; returns 404 if the invite was accepted or canceled. Returns: avatarUrl, email, githubLogin, name, role. Required: id, org_name.
- **update_a_pulumi_org_invite_by_id** — Accept a pending Pulumi organization invitation, adding the authenticated user as a member of the organization; returns 409 if the invite is not in the 'invited' state (already accepted or canceled). Returns an empty 204 response on success. Required: id, org_name.
- **delete_a_pulumi_org_invite_by_id** — Cancel a pending Pulumi organization invitation, reclaiming the seat it reserves; Returns an empty 204 response on success. Returns an empty 204 response on success. Required: org_name, id.
- **pulumi_org_invites_resend** — Resend a pending Pulumi organization invitation email, updating its sent timestamp to the current time; returns 404 if the invite was accepted or canceled. Returns an empty 204 response on success. Required: org_name, invite_id.
- **create_a_pulumi_invites_batch** — Create multiple Pulumi organization invitations in one batch; each invitee receives an email with a role assignment (admin or member) and optional team assignments. Returns the batch invite result object with upstream-defined fields. Required: org_name, org_name. Pending invites count toward the organization's seat limit.
- **create_a_pulumi_invites_link** — Create a shareable invite link for a Pulumi Cloud organization. Generates a join URL intended for copy/paste sharing — no email is sent and no email address is required in the request body. Returns the invite-link record including its id and upstream-defined attributes. Required: org_name, role.
- **create_a_pulumi_unverified_batch** — Create multiple unverified email invitations to a Pulumi organization in one batch; invitees do not need existing or verified Pulumi accounts and will be prompted to create one when they accept. Returns the batch invite result payload (shape defined by the vendor's BatchCreateOrganizationInviteResponse schema). Required: org_name, invites.
- **create_a_pulumi_org_member** — Add an existing Pulumi user to an organization with a built-in role. Returns the created member record: id and attributes (upstream OrganizationMember fields). The user must already have a Pulumi account; only built-in roles are assignable, and 409 applies if the user is already a member. Required: org_name, user_login, role.
- **list_all_pulumi_org_members** — List the members of a Pulumi organization. Returns member records: userLogin, role, fgaRoleId, Suspended. Required: org_name. Defaults to frontend members; pass type=backend for identity-provider backend members, or includeSuspended=true as an org admin to include suspended members.
- **pulumi_org_members_bulk_update** — Update a member's role within a Pulumi organization. Returns an empty 204 response on success. Set role (member, admin, or billingManager) for a built-in role or fgaRoleId for a custom role; fgaRoleId takes precedence when both are provided. Required: org_name, user_login.
- **pulumi_org_members_bulk_delete** — Remove a user from a Pulumi organization, revoking their access to its resources and removing them from all teams they belong to. Returns an empty 204 response on success. Required: org_name, user_login. The caller cannot remove themselves from the organization.
- **list_all_pulumi_member_teams** — List the teams a user belongs to within a Pulumi organization, including Pulumi-managed teams and teams synced from a backend identity provider. Returns: teams. Required: org_name, user.
- **list_all_pulumi_neo_token_budgets** — Get the current Neo-token budget for a Pulumi organization — the Neo-token allowance and consumption for the binding (closest-to-exhaustion) in-force Neo limit. Returns 404 when no Neo-token cap applies to the organization. Required: org_name.
- **list_all_pulumi_tokens_summaries** — Get the Neo AI agent token usage summary for a Pulumi Cloud organization, aggregated by time granularity over a lookback period. Returns: summary (per-period entries with resources, resourceHours, year, month) and tagKeys. May return an empty 204 response. Required: org_name, granularity.
- **list_all_pulumi_neo_usage_caps** — Get the monthly Neo usage cap configured for a Pulumi Cloud organization. Returns the cap record with its id and the cap details under attributes; cap amounts are denominated in cents. Returns no content when no cap is set (the default). Required: org_name.
- **pulumi_neo_usage_caps_bulk_update** — Create or replace the monthly Neo usage cap for a Pulumi Cloud organization. Returns the NeoUsageCap record including its id and its upstream-defined cap attributes (caps are denominated in cents). The cap must be at least $10/month; to remove the cap, use the DeleteNeoUsageCap operation. Required: org_name, capCents.
- **pulumi_neo_usage_caps_bulk_delete** — Delete the monthly Neo usage cap for a Pulumi Cloud organization, returning it to the uncapped default. Idempotent: deleting when no cap is set still succeeds. Returns an empty 204 response on success. Required: org_name.
- **list_all_pulumi_oidc_issuers** — List the OIDC issuer registrations of a Pulumi organization that establish trust with external identity providers for temporary credential token exchange. Returns: oidcIssuers. Required: org_name.
- **create_a_pulumi_oidc_issuer** — Register a new OIDC issuer for a Pulumi organization to establish trust with an external identity provider (AWS, Azure, Google Cloud, GitHub Actions, or any OIDC-compliant IdP) for token exchange. Returns: created, id, issuer, jwks, lastUsed, maxExpiration, modified, name, thumbprints, url. Required: org_name, name, url.
- **get_single_pulumi_oidc_issuer_by_id** — Get the details of a single OIDC issuer registration of a Pulumi organization by id, including its issuer URL and configuration. Returns: created, id, issuer, jwks, lastUsed, maxExpiration, modified, name, thumbprints, url. Required: id, org_name.
- **update_a_pulumi_oidc_issuer_by_id** — Update an existing OIDC issuer registration of a Pulumi organization by id; the issuer URL cannot be changed after creation and the issuer name is required. Returns: created, id, issuer, jwks, lastUsed, maxExpiration, modified, name, thumbprints, url. Required: id, org_name.
- **delete_a_pulumi_oidc_issuer_by_id** — Delete an OIDC issuer registration of a Pulumi organization by id, removing the trust relationship so its tokens can no longer be exchanged for temporary Pulumi Cloud credentials. Returns an empty 204 response on success. Required: org_name and id.
- **create_a_pulumi_issuer_regenerate_thumbprint** — Regenerate the TLS certificate thumbprints for an OIDC issuer in Pulumi Cloud by re-fetching the identity provider's public keys. Returns: created, id, issuer, jwks, lastUsed, maxExpiration, modified, name, thumbprints, url. Cannot be used when the issuer's JWKS are statically configured. Required: org_name, issuer_id.
- **list_all_pulumi_packages_usages** — List the stacks in a Pulumi organization that use a specific package, to track package adoption and plan upgrades or deprecations. Returns the package usage response object with provider-defined fields. Omitting packageName returns 400. Max 500 per page. Required: org_name.
- **list_all_pulumi_policygroups_metadata** — Get an organization's high-level policy protection metrics from Pulumi Cloud — stacks protected by policy enforcement, total Policy Groups, and overall policy coverage statistics. Returns the vendor-defined PolicyGroupMetadata metrics object. Required: org_name.
- **pulumi_policygroup_batches_bulk_update** — Apply multiple update operations to a Pulumi policy group in one batch, sending a JSON array of operations that are grouped by type (adds, removes) and processed in batches. Required: org_name, policy_group. Returns an empty 204 response on success.
- **list_all_pulumi_org_policypacks** — List all complete Policy Packs in a Pulumi organization. Returns a Policy Pack list whose shape the source documents by reference (AppListPolicyPacksResponse). Required: org_name.
- **create_a_pulumi_org_policypack** — Create a new Policy Pack for a Pulumi organization. Returns a Policy Pack object whose field set the source documents by reference (AppCreatePolicyPackResponse). The pack must contain at least one policy. Required: org_name, displayName, name, policies.
- **pulumi_org_policypacks_bulk_delete** — Delete all versions of a Policy Pack from a Pulumi organization, including the associated packs stored in S3 and any applied versions. Returns an empty 204 response on success. Required: org_name, policy_pack_name. Enabled Policy Packs cannot be deleted.
- **list_all_pulumi_policypack_versions** — Get a specific version of a Pulumi Policy Pack, including its metadata and the individual policy definitions it contains. Returns status entries for 200 (OK), 400 (version not yet complete), and 404 (not found). Required: org_name, policy_pack_name, version.
- **pulumi_policypack_versions_complete** — Finalize publication of a Pulumi Policy Pack version by transitioning its publish status to complete, making it available for enforcement once the pack content has been uploaded. Returns an empty 204 response on success. Required: org_name, policy_pack_name, version. Returns 400 if the pack is already complete.
- **pulumi_policypack_versions_bulk_delete** — Delete a specific version of a Pulumi Policy Pack and its associated pack content stored in S3. Returns status entries for 200 (OK), 404 (not found), and 409 (applied to Policy Groups). The pack version must be unapplied to be deleted. Required: org_name, policy_pack_name, version.
- **list_all_pulumi_version_schemas** — Get the JSON configuration schema for a specific version of a Pulumi Policy Pack, defining each policy's configurable parameters, allowed values, defaults, and validation rules. Returns the JSON configuration schema document; fields are pack-specific. Required: org_name, policy_pack_name, version.
- **list_all_pulumi_policyresults_issues** — List Pulumi Cloud policy issues for an organization — violations detected by Policy Packs during stack updates or continuous compliance scans. Each record covers the violating resource, policy details, enforcement level, severity, and triage status; advanced filtering uses the grid request body. Returns: groupData, policyIssues, rowCount. Required: org_name, filterModel, groupKeys, rowGroupCols, sortModel, valueCols.
- **get_single_pulumi_policyresults_issue_by_id** — Get a single Pulumi Cloud policy issue by id. The record's field-level shape follows the upstream GetPolicyIssueResponse schema, covering the violating resource, the policy pack and policy name, enforcement level, severity, and triage status. Returns: policy, policyIssue, policyPack. Required: id, org_name.
- **update_a_pulumi_policyresults_issue_by_id** — Update a Pulumi Cloud policy issue's triage status and other mutable fields by id. All body fields are optional; status accepts open, in_progress, or ignored (fixed and by_design cannot be set manually). Returns: policy, policyIssue, policyPack. Required: id, org_name.
- **create_a_pulumi_issues_export** — Export the policy issues of a Pulumi organization to CSV for offline analysis or reporting; issues are violations detected by Policy Packs during stack updates or continuous compliance scans. Returns the CSV document as plain text, with each row covering the violating resource, policy name, enforcement level, and severity. Required: org_name, filterModel, groupKeys, rowGroupCols, sortModel, valueCols.
- **list_all_pulumi_policyresults_metadata** — Get an organization's high-level policy compliance statistics in Pulumi, including total violation counts, breakdowns by severity and enforcement level, and trends over time. Returns the PolicyResultsMetadata statistics object. Required: org_name.
- **list_all_pulumi_policyresults_policies** — List policy compliance data for a Pulumi Cloud organization, grouped by policy pack and policy name with compliant and violating stack counts per policy rule. Returns the ListPoliciesComplianceResponse object; filtering and pagination are controlled via the grid request body. Required: org_name, filterModel, groupKeys, rowGroupCols, sortModel, valueCols.
- **list_all_pulumi_resources_summaries** — Get a Pulumi organization's resources under management (RUM) and resource hours under management (RHUM) usage summary by time granularity. Returns: summary, tagKeys. Required: org_name, granularity. lookbackDays and lookbackStart are mutually exclusive; hourly granularity is limited to a 2-day lookback.
- **list_all_pulumi_org_restore_stacks** — List the most recently deleted stacks in a Pulumi Cloud organization to find restore candidates. Returns deleted-stack records with id and attributes (further fields defined by the upstream ListDeletedStacksResponse schema). Up to 25 stacks are returned. Required: org_name.
- **create_a_pulumi_org_restore_stack** — Restore a soft-deleted stack in a Pulumi Cloud organization by its program identifier. Returns an empty 204 response on success. Requires org_name and restore_stack_id. Only available when the organization has the restore stacks feature enabled, and fails if a live stack with the same name already exists. Required: org_name, restore_stack_id, stackName.
- **list_all_pulumi_org_roles** — List custom roles for a Pulumi organization filtered by UX purpose; by default only roles contained within the calling user's permissions are returned. Returns roles with id, name, description. Required: org_name, uxPurpose.
- **create_a_pulumi_org_role** — Create a custom role for a Pulumi organization. Returns the created role: id, name, description. Role definitions are limited to 2000 entries per permission descriptor group and 1 MB serialized size; exceeding either returns a 400 error. Required: org_name.
- **get_single_pulumi_org_role_by_id** — Get a custom role by id in a Pulumi organization. Returns the role's details: id, name, description. Required: id, org_name.
- **update_a_pulumi_org_role_by_id** — Update a custom role's name, description, or permission scopes in a Pulumi organization; changes apply immediately to assigned members and teams. Returns the updated role: id, name, description. Same 2000-entry and 1 MB limits apply. Required: id, org_name.
- **delete_a_pulumi_org_role_by_id** — Delete a custom role from a Pulumi organization by id; deletion revokes the permissions it granted to assigned members and teams. Deleting a role that is currently assigned requires force. Returns an empty 204 response on success. Required: id, org_name.
- **list_all_pulumi_roles_scopes** — List all permission scopes that can be assigned to custom roles in a Pulumi Cloud organization. Returns a map of scope categories (e.g. stacks, teams, organization settings) to the permission scopes that can be granted or denied. Required: org_name.
- **list_all_pulumi_role_teams** — List the Pulumi Cloud teams that hold a specific organization role. Returns the upstream ListTeamsWithRoleResponse payload as-is; the vendor does not enumerate its fields. Required: org_name, role_id.
- **list_all_pulumi_role_tokens** — List the Pulumi organization tokens that have been assigned to a specific custom role, so administrators can audit which tokens hold particular permission levels and manage least-privilege access. Returns a ListAccessTokensResponse payload of matching token records. Required: org_name, role_id.
- **list_all_pulumi_role_users** — List the users assigned a specific role in a Pulumi organization. Returns the ListUsersWithRoleResponse JSON payload — the upstream reference names this schema without documenting its fields. Required: org_name, role_id.
- **list_all_pulumi_org_samls** — Get the SAML configuration for a Pulumi Cloud organization. Returns: entityId, idpSsoDescriptor, nameIdFormat, organization, ssoUrl, validUntil, validationError. Required: org_name.
- **pulumi_org_samls_bulk_update** — Update the SAML configuration for a SAML-backed Pulumi Cloud organization. Returns: entityId, idpSsoDescriptor, nameIdFormat, organization, ssoUrl, validUntil, validationError. Required: org_name.
- **list_all_pulumi_saml_admins** — List the SAML admins for a Pulumi organization. Returns: samlAdmins. Required: org_name.
- **update_a_pulumi_saml_admin_by_id** — Update the SAML admin of a Pulumi organization to the given user. Each organization supports only one SAML admin, and the new admin must not belong to other organizations. Returns an empty 204 response on success. Required: org_name, user_login.
- **list_all_pulumi_search_column_sets** — Get column-set aggregations for Pulumi Cloud resource search: unique values and counts for a field such as 'type', 'package', or 'project', used to populate filter dropdowns and faceted navigation. Returns an object whose keys are unique values of the requested field and whose values are aggregation results with resource counts. Required: org_name.
- **list_all_pulumi_resources_dashboards** — Get resource dashboard aggregations for a Pulumi organization. Returns a ResourceSearchResult aggregations object with resource counts grouped by package and other dimensions, for display on organization dashboard cards. Required: org_name.
- **list_all_pulumi_resources_exports** — Export a Pulumi organization's resource search results as a CSV file download, using the same query filters as the standard resource search. Returns the exported resource data as a text/plain CSV file. Required: org_name.
- **list_all_pulumi_resources_parses** — Convert a natural language question into a structured Pulumi resource search query using AI. Returns the AI-generated structured query as an opaque response object; the upstream reference does not enumerate its fields. AI assist requires an Enterprise subscription. Required: org_name.
- **list_all_pulumi_search_resourcesv_2_s** — Search Pulumi Cloud resources in an organization by query string, with sorting, grouping, and faceting. Returns matching resource records with urn, name, type, stack, project, created, and modified fields. Required: org_name. Page-based pagination caps at 10,000 results; use cursor for larger sets (Enterprise plans only).
- **list_all_pulumi_secrets_summaries** — Get the ESC secret-hours usage summary for a Pulumi organization. Returns the usage summary object defined by Pulumi's GetResourceCountSummaryResponse schema; a 204 No Content is returned when no usage data exists. Exactly one of lookbackDays or lookbackStart must be provided. Required: org_name, granularity.
- **create_a_pulumi_teams_github** — Create a Pulumi team backed by an existing GitHub team; membership stays managed in GitHub while stack access is controlled in Pulumi Cloud. Returns the created team object with name, kind, members, and the remaining team fields under attributes. Returns 409 if a team with the same name already exists. Required: org_name, githubTeamID.
- **create_a_pulumi_teams_pulumi** — Create a Pulumi-managed team in an organization — one whose membership is managed by Pulumi rather than GitHub or GitLab. Returns the created Team object including its name and description. Max display name length is 100 characters; a duplicate team name returns a 409. Required: org_name, description, displayName, name.
- **create_a_pulumi_team_enable_team_role** — Enable custom role-based access control for a Pulumi Cloud team so it can be assigned custom roles beyond the default team roles. Returns the created role descriptor record: id plus content-type-specific descriptor attributes. Fails with 400 if a role with this name already exists. Required: org_name, team_name.
- **list_all_pulumi_team_roles** — List the roles assigned to a Pulumi Cloud team. A team currently has a single role. Returns the upstream ListTeamRolesResponse payload; Pulumi does not document its individual fields. Required: org_name, team_name.
- **update_a_pulumi_team_role_by_id** — Assign or replace the role on a Pulumi Cloud team by upserting the team's role assignment; only one role can be assigned per team. Returns an empty 204 response on success. Required: org_name, team_name, id.
- **delete_a_pulumi_team_role_by_id** — Remove a custom role assignment from a Pulumi Cloud team, revoking the permissions the role granted to its members. Returns an empty 204 response on success. Required: org_name, team_name, id.
- **list_all_pulumi_team_tokens** — List a Pulumi team's access tokens, which inherit the team's stack permissions for scoped CI/CD access. Returns: continuationToken, tokens. Token values are never returned. Required: org_name, team_name.
- **create_a_pulumi_team_token** — Create a Pulumi team access token for CI/CD pipelines scoped to the team's stacks. Returns: id, tokenValue. Required: org_name, team_name, org_name, team_name, name. name must be unique across the organization (max 40 characters).
- **delete_a_pulumi_team_token_by_id** — Permanently revoke and delete a Pulumi team access token by id. Pipelines and automation using the token immediately lose access to the team's stacks; this cannot be undone. Returns an empty 204 response on success. Required: id, org_name, team_name.
- **list_all_pulumi_template_configurations** — Look up the configuration Pulumi Cloud stores for a project template, using the template's url as a key into the organization's template sources. Returns the stored configuration object; the API docs do not enumerate its fields. Required: org_name.
- **list_all_pulumi_template_downloads** — Download the tar template archive for a Pulumi organization. Returns the archive as an application/x-tar binary stream containing the template's project files and configuration (binary response, not a JSON object). Required: org_name.
- **list_all_pulumi_template_readmes** — Get the README for a Pulumi organization template as raw Markdown text (text/markdown), not a JSON object — the entire response body is the README content. Returns 404 if the template has no README.md file, 422 if the README content is invalid. Required: org_name.
- **list_all_pulumi_templates_sources** — List all template collections (sources) configured for a Pulumi organization, including where project templates are sourced from, such as Git repositories. Returns per-collection records with id, name, url, and templates. Required: org_name.
- **create_a_pulumi_templates_source** — Create a new template collection (source) for a Pulumi organization so members can scaffold new stacks from its templates, such as a Git repository. Returns: destination, destinationURL, error, id, isValid, name, sourceURL. Required: org_name, name, sourceURL.
- **update_a_pulumi_templates_source_by_id** — Update an existing template collection (source) for a Pulumi organization, modifying its source URL, name, or other configuration. Returns: destination, destinationURL, error, id, isValid, name, sourceURL. Required: id, org_name.
- **delete_a_pulumi_templates_source_by_id** — Delete a template collection (source) from a Pulumi organization; its templates will no longer be available to members when creating new stacks. Returns an empty 200 response on success. Required: id, org_name.
- **list_all_pulumi_org_tokens** — List organization access tokens for a Pulumi organization. Returns token metadata: id, name, description, plus a continuationToken for paging. Required: org_name. Max 1000 per page.
- **create_a_pulumi_org_token** — Create a new organization access token for a Pulumi organization, scoped to the org for CI/CD automation. Returns: id, tokenValue. Required: org_name, description, expires, admin, name.
- **delete_a_pulumi_org_token_by_id** — Delete an organization access token in Pulumi by id, immediately revoking access for any pipelines using it. Returns an empty 204 response on success. Required: org_name, id. This action cannot be undone.
- **get_single_pulumi_events_stream_by_id** — Stream events for a specific Pulumi agent task over Server-Sent Events. Existing events are delivered immediately, then the connection stays open to deliver new events in real time until the task completes. Returns a text/event-stream in which each data frame carries a JSON-encoded agent console event. Required: id, org_name.
- **create_a_pulumi_account_ownership** — Change the owner of a Pulumi Cloud Insights account to a new user. Returns the previous owner's identity object with UserInfo-defined fields. Preview endpoint. Required: org_name, account_name, avatarUrl, githubLogin, name.
- **list_all_pulumi_policy_packs** — List the policy packs configured to analyze resources in a Pulumi Insights account. Returns the account's policy packs (record fields follow the upstream Insights policy pack schema). Required: org_name, account_name.
- **create_a_pulumi_account_resource** — Create or update discovered resources in a Pulumi Insights account, reporting scanner resource state via the request body. Returns an empty 204 response on success. Required: org_name, account_name, resources.
- **get_single_pulumi_account_resource_by_id** — Get a discovered Pulumi Insights resource by id, including its current version details. Returns the discovered resource object with its version details. Required: id, org_name, account_name.
- **list_all_pulumi_resources_references** — List discovered resources with their referenced resources for a batch of resource identifiers in a Pulumi Cloud Insights account. Returns an array of resource-with-references records per the upstream InsightsResourceWithReferences schema (fields not enumerated in the docs). Required: org_name, account_name, resourceIdentifiers.
- **list_all_pulumi_resource_edges** — List the relationships (edges) between a discovered resource and other resources in a Pulumi Cloud Insights account. Returns the upstream-defined edge-list payload (attributes) — the API reference does not enumerate its fields. Max 500 results per…. Required: org_name, account_name, resource_type_and_id.
- **list_all_pulumi_resource_references** — Get a discovered cloud resource in a Pulumi Insights account along with its referenced (related) resources. Returns a record whose fields are content-type-specific, as defined by the upstream InsightsResourceWithReferences schema. Required: org_name, account_name, resource_type_and_id.
- **list_all_pulumi_resource_stack_edges** — List the Pulumi stacks that manage a specified discovered resource in Pulumi Insights. Returns the managing stacks; stack object fields are not enumerated in the API docs. resource_type_and_id must be double-URL-encoded as 'type::id'. Required: org_name, account_name, resource_type_and_id.
- **list_all_pulumi_version_edges** — List the relationships (edges) between a specific version of a discovered resource and other resources in a Pulumi Insights account. Returns: edges, nextToken. Required: org_name, account_name, resource_type_and_id, resource_version. Max 500 per page.
- **pulumi_policy_results_bulk_update** — Update the policy evaluation results for a specific version of a discovered resource in Pulumi Insights. Returns an empty 204 response on success. Required: org_name, account_name, resource_type_and_id, resource_version, claimId, results.
- **create_a_pulumi_scan_cancel** — Cancel the running resource discovery scan for a Pulumi Cloud Insights account. Returns an empty 204 response on success. Required: org_name, account_name.
- **create_a_pulumi_scan_pause** — Pause execution of future scheduled scans for a Pulumi Cloud Insights account. Returns an empty 204 response on success. Required: org_name, account_name.
- **create_a_pulumi_scan_resume** — Resume scheduled scans for a Pulumi Insights account, re-enabling execution of future scheduled scans. Returns an empty 204 response on success. Required: org_name, account_name.
- **list_all_pulumi_scan_settings** — Read the scheduled scan configuration for a Pulumi Insights account, including scan frequency and schedule details. Returns: batchSize, listConcurrency, readConcurrency, readTimeout, paused, scheduleCron. Required: org_name, account_name.
- **pulumi_scan_settings_bulk_update** — Update the scheduled scan configuration for a Pulumi Insights account, such as scan frequency and schedule. Returns an empty 204 response on success. Required: org_name, account_name, paused.
- **list_all_pulumi_account_teams** — List the teams that have been granted access to a Pulumi Cloud Insights account. Returns the JSON payload defined by the upstream ListTeamsByInsightsAccountResponse schema; its fields are not enumerated in the discovered documentation. Required: org_name, account_name.
- **pulumi_account_teams_bulk_update** — Change the permissions a team has on a Pulumi Cloud Insights account, applying the change to every child account beneath it; a missing grant is created automatically and a request matching the current permission is a no-op. Sends the JSON body defined by the upstream UpdateTeamInsightsAccountPermissionsRequest schema; its fields are not enumerated…. Required: org_name, account_name, team_name.
- **list_all_pulumi_migrations** — List the resources of a Terraform-backed Pulumi stack in Pulumi Insights, each annotated with a migrationStatus relative to an optional comparison stack; resources matching the target stack are reported as Migrated. Returns: continuationToken, resources. Required: org_name, project_name, stack_name.
- **pulumi_migrations_bulk_update** — Create or update a migration annotation on a discovered resource in Pulumi Insights, identified by its URN in the request body. Returns an empty 204 response on success. Requires org_name, project_name, stack_name, and urn; at least one of note or statusOverride must be non-empty, and statusOverride, if provided, must be Migrated. Required: org_name, project_name, stack_name, resourceUrn.
- **pulumi_migrations_bulk_delete** — Remove a migration annotation from a discovered resource in Pulumi Insights. Returns an empty 204 response on success. Requires org_name, project_name, stack_name, and resourceUrn (URN of the resource to remove the annotation from). Required: org_name, project_name, stack_name, resourceUrn.
- **create_a_pulumi_code_generate** — Generate Pulumi code that imports discovered resources into a Pulumi stack. Returns the InsightsImportCodeResponse JSON; the Pulumi Cloud API documents this response and its request body by schema name (InsightsImportCodeRequest) only. Invalid language or URNs are rejected. Preview endpoint. Required: org_name, language, urns.
- **pulumi_insightstrial_accepts_bulk_update** — Accept Insights billing charges for the specified organization in Pulumi, enabling metered billing for resource discovery. Returns an empty 204 response on success. Required: org_name.
- **pulumi_insightstrial_denies_bulk_update** — Terminate the Insights trial for a Pulumi organization, removing all associated accounts. Returns an empty 204 response on success. Required: org_name.
- **list_all_pulumi_insightstrial_summaries** — Get the Insights trial usage summary for a Pulumi Cloud organization, including resource counts and remaining trial capacity. Returns a TrialUsageSummary object; the upstream reference lists this schema without enumerating its fields. Required: org_name.
- **pulumi_update_results_bulk_update** — Update the policy evaluation results for a specific Pulumi Cloud stack update version. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, version, claimId, results.
- **get_single_pulumi_version_doc_by_id** — Get the Pulumi registry API documentation for a single package resource or function identified by its URL-encoded type token. Returns the documentation object with content-type-specific fields (JSON GetPackageDocsResponse, or raw markdown via Accept). Required: id, source, publisher, name, version.
- **list_all_pulumi_version_examples** — List Pulumi registry code examples for a specific package version, aggregated across the package's resources and functions and sorted by type token, then by example position. Returns: examples, language, navUrl, totalCount, version. Required: source, publisher, name, version.
- **list_all_pulumi_version_installations** — Get a Pulumi registry package version's installation configuration as an ordered list of content nodes. The node fields are content-type-specific and defined upstream; Accept: text/markdown returns the guide as a raw markdown string. Required: source, publisher, name, version. Returns 404 when the version does not exist or has no installation…
- **list_all_pulumi_version_navs** — Get the package navigation for a Pulumi registry package version: a flat list of modules in schema-declaration order. Returns the navigation object with content-type-specific fields (JSON or markdown via Accept); depth=summary yields module names and counts, depth=full adds resources and functions. Required: source, publisher, name, version.
- **list_all_pulumi_registry_terraform_modules** — List Terraform modules in the Pulumi Cloud registry, covering public modules plus private modules in namespaces the caller can access. Returns per entry: name, publisher, source, system, latestVersion, updatedAt. Optional filters: name (prefix), namespace. Paginated, 100 per page default. Preview endpoint; shape may change.
- **list_all_pulumi_annotations** — Get a stack annotation by kind in Pulumi Cloud. Returns 404 if the annotation does not exist. Required: org_name, project_name, stack_name, kind.
- **pulumi_annotations_bulk_update** — Create or update a stack annotation by kind in Pulumi Cloud (upsert). Returns an empty 204 response on success. Supports optimistic concurrency control: when version is supplied, the update fails with a conflict if the annotation changed since it was read. Required: org_name, project_name, stack_name, kind.
- **create_a_pulumi_batch_encrypt** — Encrypt a batch of plaintext values with a Pulumi stack's encryption key in a single request. Returns a map of each submitted plaintext value to its base64-encoded ciphertext. Returns 413 if the request body exceeds the maximum allowed content size. Required: org_name, project_name, stack_name, plaintexts.
- **create_a_pulumi_begin_update** — Begin a Pulumi stack update in one optimized call combining update creation, start, deployment export, and stack fetch. Returns the combined data needed to begin engine execution (upstream AppBeginUpdateResponse schema; fields not enumerated in the source docs). Returns…. Required: org_name, project_name, stack_name, program, updateKind.
- **pulumi_collaborators_bulk_delete** — Revoke a user's direct permission to access a Pulumi stack. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, user_name. Only explicitly granted permissions are removed; permissions inherited from team membership or organization defaults are unaffected.
- **list_all_pulumi_configs** — Get the service-managed configuration for a Pulumi Cloud stack — the ESC environment reference pointing the stack at service-backed config, used in place of the local stack config file. Returns: encryptedKey, encryptionSalt, environment, secretsProvider. Required: org_name, project_name, stack_name. 404 if none exists.
- **pulumi_configs_bulk_update** — Update a Pulumi Cloud stack's service-managed configuration to point it at an ESC (service-backed) environment. Returns the updated config: environment, secretsProvider, encryptedKey, encryptionSalt (last three deprecated — omit them). Required: org_name, project_name, stack_name, environment. 400 if the environment reference is invalid or not…
- **pulumi_configs_bulk_delete** — Delete a Pulumi Cloud stack's service-managed configuration (the ESC environment reference), causing the CLI to fall back to the local stack config file. Requires org_name, project_name, and stack_name. Returns an empty 204 response on success. Required: org_name, project_name, stack_name.
- **create_a_pulumi_decrypt_log_batch_decryption** — Record an audit log entry for a batch decryption event performed by a third-party secrets provider (e.g. AWS KMS, Azure Key Vault, or HashiCorp Vault) against a Pulumi Cloud stack, where decryption happens client-side. Returns an empty 204 response on success. Requires org_name, project_name, and stack_name. Required: org_name, project_name, stack_name.
- **create_a_pulumi_decrypt_log_decryption** — Report a third-party secret decryption event for a Pulumi Cloud stack. Records an audit log entry when a stack secret was decrypted client-side by an external secrets provider such as AWS KMS, Azure Key Vault, or HashiCorp Vault, so the CLI can report that decryption occurred. Returns an empty 204 response on success. Required: org_name, project_name, stack_name.
- **pulumi_deployments_caches_bulk_delete** — Clear all cached dependency and build artifacts for a Pulumi Deployments stack, forcing a clean build on the next deployment (e.g. when cached dependencies become stale or corrupted). Returns an empty 200 response on success. Required: org_name, project_name, stack_name.
- **create_a_pulumi_drift_schedule** — Create a drift detection schedule for a Pulumi Cloud stack using Pulumi Deployments. Returns the created ScheduledAction with its id, scheduleCron, and autoRemediate settings. The stack must have deployment settings configured, and setting autoRemediate to true requires…. Required: org_name, project_name, stack_name.
- **update_a_pulumi_drift_schedule_by_id** — Update the configuration of an existing drift detection schedule for a Pulumi Cloud stack. Returns the updated ScheduledAction with its id, scheduleCron, and autoRemediate settings. Only future executions are affected; past drift detection runs are not modified, and…. Required: id, org_name, project_name, stack_name.
- **list_all_pulumi_deployments_settings** — Get the Pulumi Deployments settings configured for a stack in Pulumi. Returns: agentPoolID, cacheOptions, executorContext, gitHub, operationContext, source, sourceContext, tag, vcs, version. Required: org_name, project_name, stack_name. Returns 404 when the stack has no deployment settings.
- **create_a_pulumi_deployments_setting** — Create or merge Pulumi Deployments settings for a stack; null patch values remove properties, non-object values are replaced, and objects merge. Returns: agentPoolID, cacheOptions, executorContext, gitHub, source, tag, vcs, version, and 2 more. Required: org_name, project_name, stack_name. Requires Team Growth or higher subscription.
- **pulumi_deployments_settings_bulk_delete** — Delete all Pulumi Deployments settings for a stack, after which it can no longer run deployments until new settings are configured. Returns a boolean success indicator. Required: org_name, project_name, stack_name. Active schedules (drift detection, TTL, or custom) may be affected.
- **create_a_pulumi_ttl_schedule** — Create a TTL schedule for a Pulumi Cloud stack that destroys its cloud resources at an expiration time, optionally deleting the stack afterwards. Returns: created, definition, id, kind, lastExecuted, modified, nextExecution, orgID, paused, and 2 more. The stack must have deployment settings configured. Required: org_name, project_name, stack_name.
- **update_a_pulumi_ttl_schedule_by_id** — Update an existing TTL schedule for a Pulumi Cloud stack, changing when its resources are destroyed or if the stack is deleted afterwards. Returns: created, definition, id, kind, lastExecuted, modified, nextExecution, orgID, paused, and 2 more. Timestamp must be a valid future date-time. Required: id, org_name, project_name, stack_name.
- **list_all_pulumi_deployments_versions** — Get a specific Pulumi Deployments execution by its version number within a stack. Returns: configuration, created, id, initiator, jobs, latestVersion, modified, pulumiOperation, requestedBy, status, version. Required: org_name, project_name, stack_name, version.
- **list_all_pulumi_deployment_updates** — List all stack updates produced by a Pulumi Deployments deployment execution; a single deployment may produce one or more updates. Returns: githubCommitInfo, info, latestVersion, policyPacks, requestedBy, requestedByToken, updateID, version. Required: org_name, project_name, stack_name, deployment_id.
- **list_all_pulumi_downstreamreferences** — List all Pulumi stacks that reference the specified stack as a dependency in their Pulumi programs via StackReference. Returns each referencing stack's organization, project, name, and version. Required: org_name, project_name, stack_name.
- **list_all_pulumi_drift_runs** — List drift detection runs for a Pulumi stack. Returns each drift run's id along with whether drift was detected and any remediation actions taken. Required: org_name, project_name, stack_name. Max 100 per page.
- **get_single_pulumi_drift_run_by_id** — Get a single drift detection run for a Pulumi stack by id. Returns the drift run's id along with whether drift was detected and details of any detection and remediation updates. Required: id, org_name, project_name, stack_name.
- **list_all_pulumi_drift_status** — Get the current drift detection status for a Pulumi Cloud stack — whether drift was detected, when the last drift check ran, and details of any detected differences. Returns the StackDriftStatus record as id plus an attributes object holding the drift fields. Required: org_name, project_name, stack_name.
- **create_a_pulumi_import** — Import a deployment state snapshot into a Pulumi stack, replacing its current state — typically for state migration between backends, state repair, or restoring from backup. The body must be a complete untyped deployment object in the same format returned by the ExportStack endpoint. Returns the imported deployment record including its version,…. Required: org_name, project_name, stack_name.
- **pulumi_notifications_settings_bulk_update** — Update the notification settings for a Pulumi stack, controlling whether notifications are sent on update success or failure. Returns the updated stack metadata (id) including the new notification settings. Required: org_name, project_name, stack_name, notifyUpdateFailure, notifyUpdateSuccess.
- **list_all_pulumi_outputs** — Get the outputs of a Pulumi stack without the rest of its state, as recorded by the stack's most recent completed update. Returns the outputs map (secret values as ciphertext secret objects) and the stack's secretsProviders. Required: org_name, project_name, stack_name.
- **list_all_pulumi_policygroups** — List the policy groups that include a specific stack in Pulumi Cloud. Policy groups define which policy packs are enforced on a set of stacks. Returns policy groups with their name, the stacks they apply to, and the policy packs configured within them. Required: org_name, project_name, stack_name.
- **list_all_pulumi_policypacks** — List the policy packs enforced on a Pulumi Cloud stack through its policy group memberships. Returns each enforced policy pack record: id plus provider-defined attributes. Required: org_name, project_name, stack_name.
- **get_single_pulumi_preview_summary_by_id** — Get a concise summary of a specific preview operation in Pulumi Cloud by update ID. Returns: endTime, resourceCount, result, startTime. Required: org_name, project_name, stack_name, id. Returns 404 if the specified update does not exist.
- **list_all_pulumi_resources_counts** — Get the total number of resources currently managed by a Pulumi stack, based on its most recent update. Lightweight stack-size check. Returns: resourceCount, version. Required: org_name, project_name, stack_name.
- **create_a_pulumi_transfer** — Transfer a Pulumi stack from one organization to another. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, toOrg. The stack must have no updates in progress (409 otherwise), and the requesting user must be a member of both organizations.
- **list_all_pulumi_updates_latests** — Get the most recent update for a Pulumi Cloud stack. Returns the latest update as a generic attributes object — id plus update fields (operation kind, start and end times, result status, resource changes summary, configuration, and environment details) defined by the upstream UpdateInfo schema. Required: org_name, project_name, stack_name. Returns…
- **list_all_pulumi_latest_previews** — List the preview (dry-run) operations associated with the latest stack update version of a Pulumi stack. Returns each preview's update record including its info (kind, result, start/end times), version, requestedBy, and policyPacks. Required: org_name, project_name, stack_name.
- **list_all_pulumi_latest_timelines** — Get the timeline of workflow events (deployment triggers, previews, and the final update operation) culminating in the most recent update of a Pulumi stack. Returns: collatedPullRequest, collatedUpdateEvents, previews, update. Required: org_name, project_name, stack_name. Returns 404 if no update exists.
- **list_all_pulumi_update_previews** — List all preview operations recorded for a specific Pulumi stack update version — multiple previews can exist when a stack is previewed several times before an update is applied. Returns the preview operations as a GetStackUpdatesResponse payload, sorted newest-first by default. Required: org_name, project_name, stack_name, version.
- **list_all_pulumi_update_timelines** — Get the Pulumi Cloud update timeline for a stack update version, covering deployment triggers, previews, and the update operation itself. Returns the GetUpdateTimelineResponse payload; its event fields are not enumerated in the docs. Required: org_name, project_name, stack_name, version.
- **list_all_pulumi_upstreamreferences** — List the stacks the specified Pulumi Cloud stack references as upstream dependencies via StackReference. Returns each referenced stack's organization, project, name, and version. Required: org_name, project_name, stack_name.
- **list_all_pulumi_users** — Get the authenticated Pulumi user's profile information. Returns: avatarUrl, email, githubLogin, hasMFA, id, identities, isAgent, isManagedByMultiOrg, isOrgManaged, name, organizations, potentialOrganizations, registryAdmin, siteAdmin, tokenInfo.
- **list_all_pulumi_user_pending_emails** — Get the latest pending email change for the currently authenticated Pulumi user. Returns the pending email change record; an empty 204 response is returned when no pending email change requests exist.
- **pulumi_user_pending_emails_bulk_delete** — Delete the pending email change for the currently authenticated Pulumi user. Returns an empty 204 response on success. The pending verification cannot be deleted if it is the verification record for the current primary email.
- **list_all_pulumi_user_pending_invites** — List the pending Pulumi Cloud organization invites for the requesting user. Each returned invite includes its id, recipient email, assigned role, status, sentAt timestamp, sentBy sender details, and acceptInviteUrl.
- **list_all_pulumi_user_stacks** — List the Pulumi stacks accessible to the authenticated user, filterable by organization, project, tags, and custom role, with token-based pagination. Returns stack summary records (AppListStacksResponse) whose fields are not enumerated in the upstream docs — name, project, last update status, and resource count are described in prose only. No…
- **list_all_pulumi_user_tokens** — List Pulumi access tokens bound to the authenticated user, including personal access tokens and refresh tokens issued during agent signup (web-session tokens are excluded). Returns: continuationToken, tokens.
- **create_a_pulumi_user_token** — Create a Pulumi personal access token for the authenticated user. Returns: id, tokenValue. Required: description, expires.
- **delete_a_pulumi_user_token_by_id** — Delete a Pulumi personal access token by id; the token is immediately invalidated and can no longer authenticate. Returns an empty 204 response on success. Required: id.
- **pulumi_user_vcs_bulk_delete** — Remove a VCS identity provider (e.g., github, gitlab, bitbucket) from the current Pulumi user's account. Returns the updated user record as id plus content-type-specific attributes. The account must keep more than one identity provider.
- **list_all_pulumi_vcs_organizations** — List the VCS organizations visible to the Pulumi Service for the requesting user. Returns: organizations. Providers the user has no linked identity for are skipped.
- **create_a_pulumi_vcs_sync** — Sync the Pulumi user's profile with their VCS identity provider, refreshing profile details the provider maintains (display name, avatar URL, etc.). Returns the updated user record: id plus the upstream User schema fields under attributes.
- **list_all_pulumi_user_verified_emails** — Check whether the authenticated Pulumi user has a verified email. Returns a boolean result: true when a verified email exists; the API responds with 404 Not Found when the user's email is not verified. Takes no parameters.
- **list_all_pulumi_change_request_events** — List the event log of a Pulumi Cloud change request, including approvals, status changes, and other lifecycle events. Returns events with id plus event-type-specific fields. Required: org_name, change_request_id.
- **pulumi_change_requests_approve** — Approve a Pulumi Cloud change request on behalf of the authenticated user; once the required number of approvals is met the request can be applied. Returns an empty 204 response on success. Required: org_name, change_request_id, revisionNumber.
- **pulumi_change_requests_close** — Close a Pulumi Cloud change request without applying it, discarding the proposed infrastructure changes and marking it as closed. Returns an empty 204 response on success. Required: org_name, change_request_id.
- **get_single_pulumi_change_request_by_id** — Get a single Pulumi Cloud change request by id, including its current status, description, approvals, and the proposed infrastructure changes. Returns: action, createdAt, createdBy, description, entity, id, latestRevisionNumber, orgID, status, gateEvaluation. Required: id, org_name.
- **list_all_pulumi_change_requests** — List Pulumi Cloud change requests for an organization, with pagination and filtering by entity type and entity id. Returns per record: id, status, description, approvals. Required: org_name.
- **pulumi_change_requests_submit** — Submit a draft Pulumi Cloud change request for approval, moving it into the review workflow where it requires the configured number of approvals before it can be applied. Returns an empty 204 response on success. Required: org_name, change_request_id.
- **update_a_pulumi_change_request_by_id** — Update a Pulumi change request's metadata. Currently only the description field can be modified after creation. Returns an empty 204 response on success. Required: id, org_name, description.
- **list_all_pulumi_stack_activities** — List the activity history for a Pulumi Cloud stack, including updates, configuration changes, and other operations. Returns the activity list with each entry's deployment and update details, plus total and itemsPerPage counts. Required: org_name, project_name, stack_name. Max 500 per page.
- **create_a_pulumi_stack** — Create a stack in Pulumi Cloud within an organization and project, creating the project too if it does not exist; the stack name must be unique within the project. Returns the created stack: id, stackName, org_name, project_name, version, tags, activeUpdate, and currentOperation. Required: org_name, project_name, stackName.
- **delete_a_pulumi_stack_by_id** — Delete a stack in Pulumi Cloud. By default the stack must have no resources remaining; pass force=true to delete it even when it still manages resources. Deletion is a soft-delete that hides the stack from normal queries. Returns an empty 204 response on success. Required: id, org_name, project_name.
- **get_single_pulumi_stack_by_id** — Get a single stack in Pulumi Cloud by id and inspect its current state and metadata. Returns: activeUpdate, config, currentOperation, id, orgName, projectName, stackName, tags, version. Required: org_name, project_name, id.
- **create_a_pulumi_org_hook** — Create a Pulumi organization-level webhook that notifies an external service on stack, deployment, drift-detection, or policy-violation events. Returns the created webhook: id, name, payloadUrl, format, filters, active. Defaults: format to raw. Required: org_name, active, displayName, organizationName, payloadUrl.
- **delete_a_pulumi_org_hook_by_id** — Delete a Pulumi organization-level webhook by id, permanently stopping its event notifications. Returns an empty 204 response on success. Required: id and org_name.
- **get_single_pulumi_org_hook_by_id** — Get a Pulumi organization-level webhook by id. Returns: active, displayName, envName, filters, format, groups, name, organizationName, payloadUrl, projectName, secret, stackName, hasSecret, secretCiphertext. Required: id and org_name.
- **list_all_pulumi_org_hooks** — List all webhooks configured at the organization level in Pulumi. Returns each webhook's id, name, payloadUrl, format, active status, and subscribed event filters. Required: org_name.
- **update_a_pulumi_org_hook_by_id** — Update a Pulumi organization-level webhook by id, changing its destination URL, format, active status, event filters, or secret. Returns the updated webhook: id, name, payloadUrl, format, filters, active. Required: id and org_name. The 'pulumi_deployments' format is not valid for organization-level webhooks.
- **get_single_pulumi_org_by_id** — Get a Pulumi organization's details by name. Returns: avatarUrl, githubLogin, name, repos. Required: id.
- **update_a_pulumi_org_by_id** — Update a Pulumi organization's settings, such as the default stack permission level for new members and whether members can create teams. Returns the updated organization metadata: name, displayName, avatarUrl, memberCount, and features. Required: id.
- **create_a_pulumi_stack_tag** — Create a new tag on a Pulumi Cloud stack. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, name, value. Reserved name prefixes 'pulumi:', 'gitHub:' and 'vcs:' belong to built-in tags that Pulumi refreshes from project metadata.
- **delete_a_pulumi_stack_tag_by_id** — Delete a tag from a Pulumi Cloud stack by its name. Returns an empty 204 response on success. Built-in tags managed by Pulumi cannot be deleted. Required: id, org_name, project_name, stack_name.
- **update_a_pulumi_stack_tag_by_id** — Update the value of an existing tag on a Pulumi Cloud stack, identified by the tag name. Returns an empty 204 response on success. Built-in tags cannot be updated. Required: id, org_name, project_name, stack_name.
- **pulumi_stack_tags_bulk_update** — Replace all tags on a Pulumi Cloud stack with a JSON map of tag name-value pairs; existing tags not included are removed. Returns an empty 204 response on success. Required: org_name, project_name, stack_name. Include built-in 'pulumi:', 'gitHub:' and 'vcs:' tags unchanged.
- **delete_a_pulumi_team_by_id** — Delete a team from a Pulumi organization by id. Revokes the team's stack permission grants, removes access granted solely through team membership, and invalidates the team's tokens; the action cannot be undone. Returns an empty 204 response on success. Required: id, org_name.
- **get_single_pulumi_team_by_id** — Get a Pulumi organization team by id. Returns the full team object including name, displayName, description, type, members, and stackPermissions. Required: id, org_name.
- **list_all_pulumi_teams** — List all teams in a Pulumi organization. Returns each team's name, type (Pulumi-managed, GitHub-backed, or GitLab-backed), and member count. Teams are available to organizations on Enterprise and Business Critical editions. Required: org_name.
- **update_a_pulumi_team_by_id** — Update a Pulumi organization team by id: add or remove members (member, memberAction), grant a stack permission (addStackPermission: 101 read, 102 edit, 103 admin), or revoke (removeStack). Returns an empty 204 response on success. Not available to individual organizations. Required: id, org_name.
- **list_all_pulumi_agent_task_events** — List the event stream for a specific Pulumi agent task, including agent messages, tool calls, status changes, and user interactions. Returns: continuationToken, events. Required: org_name, task_id. Page size must be between 1 and 1000.
- **pulumi_agent_tasks_cancel** — Force-cancel a Pulumi agent task: immediately terminates its runtime session and resets the task to idle without notifying the agent runtime. Returns an empty 204 response on success. Required: org_name, task_id, force.
- **create_a_pulumi_agent_task** — Create a Pulumi agent task for an organization by submitting the prompt (the user event message whose type discriminator must be set to "user_message") that initiates it. Returns the created task details including id, name, and createdAt. Required: org_name.
- **get_single_pulumi_agent_task_by_id** — Get a Pulumi agent task by id. Returns the task's metadata including id, name, and createdAt. Required: id, org_name.
- **list_all_pulumi_agent_tasks** — List Pulumi agent tasks for an organization, filterable by status, task type, agent definition, source, and case-insensitive name match, with configurable sorting. Returns task records including id, name, and createdAt. Required: org_name.
- **update_a_pulumi_agent_task_by_id** — Update the settings or metadata of a Pulumi agent task; only the user who created the task can modify it, and changes take effect with the task's next conversation turn. Returns the updated task including id, name, and createdAt. Required: id, org_name.
- **create_a_pulumi_preview_event** — Record a single engine event for a Pulumi stack preview — an individual resource operation or diagnostic message from the CLI. For better performance, send multiple events at once via the batch events endpoint. Returns an empty 200 response on success. Required: org_name, project_name, stack_name, update_id, sequence, timestamp.
- **list_all_pulumi_preview_events** — List the engine events produced during a Pulumi stack preview — individual resource operations and diagnostic messages. Returns: continuationToken, events. Required: org_name, project_name, stack_name, update_id.
- **get_single_pulumi_preview_update_by_id** — Get a specific preview operation for a Pulumi Cloud stack by id. Returns: githubCommitInfo, info, latestVersion, policyPacks, requestedBy, requestedByToken, updateID, version. Returns 404 if the preview does not exist. Required: id, org_name, project_name, stack_name.
- **pulumi_previews_cancel** — Request cancellation of an in-progress Pulumi preview update on a stack. Cancellation is processed asynchronously and the update transitions to a cancelled state. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, update_id.
- **pulumi_previews_complete** — Mark a service-managed Pulumi preview update as complete by submitting its final status. Returns an empty 204 response on success; returns 400 for an unrecognized status and 409 if the update has not started, was cancelled, already timed out, or already completed. Required: org_name, project_name, stack_name, update_id, status.
- **create_a_pulumi_preview** — Create a new preview update for a Pulumi stack — a dry run showing what changes a deploy would make without applying them. Returns the created preview update record, which must subsequently be started via start. Enforces stack update concurrency checks. Required: org_name, project_name, stack_name, config, description, main, metadata, name, options, runtime.
- **get_single_pulumi_preview_by_id** — Get the current status and results of a Pulumi preview update, including whether it is still in progress, succeeded, or failed. Returns the status and results payload; the response fields are not enumerated in the documentation. Required: id, org_name, project_name, stack_name.
- **pulumi_previews_start** — Start execution of a previously created Pulumi preview update. Returns: journalVersion, token, tokenExpiration, version. Required: org_name, project_name, stack_name, update_id. Returns 404 if the update does not exist and 409 if another update is already in progress.
- **create_a_pulumi_update_event** — Record a single engine event sent during a Pulumi stack update. Returns an empty 200 response on success. For better performance, prefer the batch events endpoint when sending multiple events. Required: org_name, project_name, stack_name, update_id, sequence, timestamp.
- **list_all_pulumi_update_events** — List the engine events for a Pulumi stack update. Returns: continuationToken, events. Required: org_name, project_name, stack_name, update_id.
- **create_a_pulumi_update_log** — Append a log entry to a Pulumi stack update's log stream, recording diagnostic messages, status information, and other output generated during the update. Returns an empty 204 response on success. The log entry is sent as a JSON request body. Required: org_name, project_name, stack_name, update_id, fields, kind.
- **pulumi_updates_cancel** — Cancel a service-managed Pulumi update that is currently in progress. Cancellation is processed asynchronously and the update transitions to a cancelled state. Returns an empty 204 response on success. Required: org_name, project_name, stack_name, update_id.
- **pulumi_updates_complete** — Mark a service-managed Pulumi update as complete by reporting its final status. Returns an empty 204 response on success. Fails if the status is unrecognized or the update is not in a completable state. Required: org_name, project_name, stack_name, update_id, status.
- **create_a_pulumi_update** — Create a new standard update (pulumi up) for a Pulumi stack to deploy infrastructure changes. This only creates the update record; the update must subsequently be started before it runs. Returns the created update program response. Required: org_name, project_name, stack_name, config, description, main, metadata, name, options, runtime.
- **get_single_pulumi_update_by_id** — Get the current status and results of a standard (pulumi up) update in Pulumi, including whether it is still in progress, succeeded, or failed. Returns the update results object. Required: id, org_name, project_name, stack_name.
- **list_all_pulumi_updates** — List the update history for a Pulumi stack. Returns the stack's update history entries. Set output-type to switch from the legacy to the paginated response format. Required: org_name, project_name, stack_name.
- **pulumi_updates_start** — Start a previously created standard (pulumi up) update in Pulumi Cloud. Returns a start confirmation with the lease token, its expiration timestamp, journal version, and the update's version number. Required: org_name, project_name, stack_name, update_id. The update must be created first; fails if another update is already in progress on the stack.
- **list_all_pulumi_deleted_envs** — List soft-deleted Pulumi ESC environments in an organization that are still within the retention window and eligible for restoration. Returns each entry's organization, project, name, created, and modified timestamps. Required: org_name.
- **pulumi_deleted_envs_restore** — Restore a previously deleted Pulumi ESC environment in an organization by its project and name. Returns an empty 204 response on success. The environment must still be within the retention window and not yet permanently purged. Required: org_name, name, project, deletionTimestamp.
- **pulumi_envs_clone** — Clone a Pulumi ESC environment into a destination project and/or under a new name — the mechanism for moving or renaming environments, since they cannot be renamed directly. Returns an empty 204 response on success. Required: org_name, project_name, env_id, name.
- **create_a_pulumi_env** — Create a new Pulumi ESC environment in an organization; the environment starts with an empty YAML definition and its name must be unique within the project (alphanumeric characters, hyphens, underscores, and periods only). No content body is returned on success. Required: org_name, name, project.
- **delete_a_pulumi_env_by_id** — Delete a Pulumi ESC environment by id, permanently removing its revision history, tags, and associated configuration. No content body is returned on success. Returns an empty 204 response on success. Required: id, org_name, project_name.
- **get_single_pulumi_env_by_id** — Get a Pulumi ESC environment by id, returning its YAML definition (imports, values, provider configurations, and function invocations) with secrets still in encrypted form. No content body is returned in JSON form; response metadata is carried in the ETag and Pulumi-ESC-Revision headers. Required: id, org_name, project_name.
- **list_all_pulumi_envs** — List Pulumi ESC environments accessible to the authenticated user across all their organizations. Returns paginated entries that include the environment's organization, project, and name plus creation/modification timestamps.
- **update_a_pulumi_env_by_id** — Update a Pulumi ESC environment's YAML definition in Pulumi. Sends the complete environment definition as raw YAML, validates it, and creates a new immutable revision. Returns the revision metadata: etag, revision. Returns 409 if the environment changed since it was last read. Required: id, org_name, project_name, body.
- **list_all_pulumi_environment_tag_summaries** — List all unique environment tag names and their distinct values across every Pulumi ESC environment in an organization. Returns a map of tag names (keys) to lists of their distinct tag values (values). Required: org_name.
- **create_a_pulumi_environment_tag** — Create a user-defined tag on a Pulumi ESC environment. Returns the created tag with its name, value, and audit metadata (created, modified, editorLogin). A tag name that already exists on the environment is rejected. Required: org_name, project_name, env_name, name, value.
- **delete_a_pulumi_environment_tag_by_id** — Delete a user-defined tag from a Pulumi ESC environment, identified by its tag name. Returns an empty 204 response on success. Requires org_name, project_name, env_name, and id (the tag name). Required: id, org_name, project_name, env_name.
- **get_single_pulumi_environment_tag_by_id** — Get a single user-defined tag of a Pulumi ESC environment by its tag name. Returns: created, editorLogin, editorName, modified, name, value. Required: id, org_name, project_name, env_name.
- **list_all_pulumi_environment_tags** — List the user-defined tags of a Pulumi ESC environment. Returns: nextToken, tags. Required: org_name, project_name, env_name.
- **update_a_pulumi_environment_tag_by_id** — Update the value of an existing user-defined tag on a Pulumi ESC environment, identified by its tag name. Returns the updated tag with its name, value, and audit metadata (created, modified, editorLogin). Required: id, org_name, project_name, env_name, currentTag, newTag.
- **create_a_pulumi_esc_webhook** — Create a webhook on a Pulumi ESC environment so an external service is notified of environment events such as updates and opens. Returns the created webhook with name, payloadUrl, format, filters, and active. Returns 409 if a webhook with the same name already exists. Required: org_name, project_name, env_name, active, displayName, organizationName, payloadUrl.
- **delete_a_pulumi_esc_webhook_by_id** — Delete a webhook from a Pulumi ESC environment; the external service will no longer receive notifications for environment events. Returns an empty 204 response on success. Required: id, org_name, project_name, env_name.
- **get_single_pulumi_esc_webhook_by_id** — Get a single webhook configured on a Pulumi ESC environment by id. Returns the webhook's name, payloadUrl, filters, format, and active. Required: id, org_name, project_name, env_name.
- **list_all_pulumi_esc_webhooks** — List all webhooks configured for a Pulumi ESC environment. Each entry includes name, payloadUrl, filters, format, and active. Required: org_name, project_name, env_name.
- **update_a_pulumi_esc_webhook_by_id** — Update an existing webhook on a Pulumi ESC environment, including its destination URL, event filters, format, and active status. Returns the updated webhook with name, payloadUrl, filters, format, and active. Returns 400 if an invalid format is specified. Required: id, org_name, project_name, env_name.
- **create_a_pulumi_stack_webhook** — Create a new webhook for a Pulumi Cloud stack. Returns the created webhook including name, displayName, payloadUrl, format, filters, groups, and active status. A webhook with the same name returns 409. Required: org_name, project_name, stack_name, active, displayName, organizationName, payloadUrl.
- **delete_a_pulumi_stack_webhook_by_id** — Delete a webhook from a Pulumi Cloud stack by id (the webhook's name). Returns an empty 204 response on success. Required: org_name, project_name, stack_name, id.
- **get_single_pulumi_stack_webhook_by_id** — Get a single webhook configured on a Pulumi Cloud stack by id (the webhook's name). Returns the webhook including name, displayName, payloadUrl, format, filters, groups, and active status. Required: org_name, project_name, stack_name, id.
- **list_all_pulumi_stack_webhooks** — List all webhooks configured on a Pulumi Cloud stack. Each webhook includes name, displayName, payloadUrl, format, filters, groups, and active status. Required: org_name, project_name, stack_name.
- **update_a_pulumi_stack_webhook_by_id** — Update an existing webhook's configuration on a Pulumi Cloud stack by id (the webhook's name). Returns the updated webhook including name, displayName, payloadUrl, format, filters, groups, and active status. Required: org_name, project_name, stack_name, id.
- **list_all_pulumi_audit_logs** — List audit log events for a Pulumi organization. Returns: auditLogEvents, continuationToken. Required: org_name.
- **create_a_pulumi_policy_group** — Create a policy group in a Pulumi organization. Returns an empty 204 response on success. Required: org_name, name.
- **delete_a_pulumi_policy_group_by_id** — Delete a policy group from a Pulumi organization by id. Returns an empty 204 response on success. The organization's default policy group cannot be deleted. Required: id, org_name.
- **get_single_pulumi_policy_group_by_id** — Get a Pulumi organization's policy group by id — the id is the policy group's name. Returns: accounts, agentPoolId, appliedPolicyPacks, entityType, isOrgDefault, mode, name, stacks. Required: org_name and id.
- **list_all_pulumi_policy_groups** — List a Pulumi organization's policy groups. Returns each group's id, name, created_at, and attributes covering the applied policy packs and assigned stacks or cloud accounts. Required: org_name.
- **update_a_pulumi_policy_group_by_id** — Update a Pulumi organization's policy group by id (the id is the policy group's name) — rename it or add/remove stacks, policy packs, or Insights accounts. Returns an empty 204 response on success. Required: org_name and id. Default policy groups cannot be renamed; enforcement mode is fixed once created.
- **list_all_pulumi_issues_filters** — Get the available filter options (policy packs, enforcement levels, severity, resource types) for policy issues in a Pulumi organization. Returns: field, values. Required: org_name, field.
- **list_all_pulumi_policyresults_compliances** — Get policy compliance results for a Pulumi Cloud organization grouped by stack, cloud account, or severity to power the compliance dashboard. Returns: columns, continuationToken, rows. Required: org_name, entity.
- **pulumi_workflows_search** — Generate a customized CI/CD starter workflow template for a Pulumi Cloud stack, tailored to the stack's runtime and configuration. Returns 400 if the CI system is not specified or the stack does not have a runtime tag, and 404 if no matching workflow template exists. Required: org_name, project_name, stack_name, ciSystem, enablePathFilters, workingDirectory.
- **create_a_pulumi_agent_task_response** — Send a user response to an ongoing Pulumi Neo agent task, such as a message, confirmation, or cancel event. Returns an empty 202 response on success. Returns 409 if the task already has a pending request that has not completed. Required: org_name, task_id.
- **create_a_pulumi_change_request_comment** — Add a comment to a Pulumi Cloud change request without approving or closing it, so reviewers can share feedback or ask questions before a decision. Returns an empty 204 response on success. Requires org_name, change_request_id, and a JSON comment body. Required: org_name, change_request_id, comment.
- **create_a_pulumi_stack_rename** — Rename a Pulumi Cloud stack identified by org_name, project_name, and stack_name, optionally moving it to a different project. Returns: updateId. Fails if another update is currently in progress on the stack. Required: org_name, project_name, stack_name, newName, newProject.
- **list_all_pulumi_stack_deployments** — List Pulumi Deployments executions for a stack. Returns deployments with id, status, version, created, modified, requestedBy and pulumiOperation. Required: org_name, project_name, stack_name.
- **create_a_pulumi_stack_deployment** — Start a Pulumi Deployments execution (update, preview, refresh or destroy) for a stack, using the stack deployment settings when inheritSettings is true. Runs on Pulumi-hosted or self-hosted agents and consumes deployment minutes. Returns id, version and consoleUrl. Required: org_name, project_name, stack_name, operation.
- **get_single_pulumi_stack_deployment_by_id** — Get a Pulumi Deployments execution by id. Returns status, created, modified, version, jobs (with steps), configuration and requestedBy. Required: org_name, project_name, stack_name, id.
- **pulumi_stack_deployments_cancel** — Cancel an in-progress or queued Pulumi Deployments execution. Returns an empty response on success. Required: org_name, project_name, stack_name, deployment_id.
- **list_all_pulumi_stack_deployment_logs** — Get execution logs for a Pulumi Deployments run, either streamed with continuationToken or for a specific job and step. Returns log lines and a nextToken. Required: org_name, project_name, stack_name, deployment_id.

## How it works

1. **Link your customer's Pulumi account.** Use Truto's frontend SDK; we handle every OAuth and API key flow so you don't need to create the OAuth app.
2. **Authentication is automatic.** Truto refreshes tokens, stores credentials securely, and injects them into every API request.
3. **Call Truto's API to reach Pulumi.** The Proxy API is a 1-to-1 mapping of the Pulumi API.
4. **Get a unified response format.** Every response uses a single shape, with cursor-based pagination and data in the `result` field.

## Use cases

- **Embed Pulumi deployments in your Internal Developer Portal** — Platform engineering SaaS companies can let their users scaffold stacks, trigger previews, and run updates against Pulumi Cloud directly from their portal — turning Pulumi into the execution engine behind one-click environment provisioning.
- **Correlate cloud security findings with IaC ownership** — CSPM and cloud security products can ingest Pulumi policy violations, resource graphs, and stack ownership metadata to tie runtime risk back to the exact Pulumi stack, team, and developer responsible.
- **Add pre-deployment cost estimates to Pulumi change requests** — FinOps and cloud cost platforms can subscribe to Pulumi preview events, analyze the proposed resource diff, and post estimated spend back into the Pulumi change request before any infrastructure is applied.
- **Pipe rotated secrets straight into Pulumi ESC** — Secrets managers and identity brokers can push updated, encrypted configuration into Pulumi Environments or register as an OIDC issuer so customer deployments always run with fresh, zero-trust credentials.
- **Gate infrastructure changes behind external approval workflows** — ITSM and governance tools can hook into Pulumi change requests to require ticket approvals, compliance sign-off, or risk review before any stack update is allowed to proceed.

## What you can build

- **One-click stack provisioning from templates** — Let users pick a Pulumi template source, create a new stack, and kick off an initial update — all from inside your UI with live progress streamed from Pulumi's update timeline.
- **Live deployment status dashboards** — Render real-time preview and update progress by polling update events, timelines, and summaries, giving users a native view of what Pulumi is doing without leaving your product.
- **Policy violation and drift inbox** — Pull Pulumi CrossGuard policy results, compliance findings, and drift run status into a unified triage queue where users can assign, update, and export issues.
- **Change request approval integration** — Surface open Pulumi change requests inside your workflow tool, let reviewers approve, close, or comment, and sync the decision back to Pulumi automatically.
- **Pulumi ESC environment and secret sync** — Create, update, and clone Pulumi Environments, batch-encrypt secrets, and trigger rotations so your platform can act as the source of truth for configuration flowing into Pulumi.
- **Resource graph search and export** — Expose Pulumi Insights search and graph queries so users can discover resources across stacks, map dependencies, and export results into reports or downstream systems.

## FAQs

### How does Truto handle authentication with Pulumi Cloud?

Truto manages the Pulumi access token credentials your end users provide (organization, team, or personal tokens) and attaches them to every API call. You don't store or rotate Pulumi tokens yourself — Truto handles credential storage and injection.

### Can we trigger infrastructure deployments programmatically through this integration?

Yes. The integration exposes Pulumi Deployments actions including creating previews, starting and completing updates, cancelling in-flight updates, scheduling drift and TTL runs, and streaming update events — so you can orchestrate full deployment lifecycles from your product.

### Does the integration support Pulumi ESC (Environments, Secrets, and Configuration)?

Yes. You can list, create, update, clone, and delete environments, manage environment tags, batch encrypt secrets, run rotations, and configure ESC webhooks, giving you full programmatic control over Pulumi ESC.

### How do we react to events in Pulumi in near real time?

Pulumi exposes organization hooks, stack webhooks, and ESC webhooks, all manageable through the integration. You can register endpoints to receive update, preview, drift, and environment events instead of polling.

### Can we read policy and compliance results from Pulumi CrossGuard?

Yes. The integration supports listing policy packs, policy groups, policy results, violations, compliance mappings, and individual issues — including updating issue triage state and exporting results for downstream security or GRC tooling.

### What VCS and cloud provider integrations are reachable through the Pulumi API?

You can manage Pulumi's own integrations with GitHub, GitHub Enterprise, GitLab, Bitbucket, Azure DevOps, and custom VCS, as well as AWS, Azure, and GCP account setups and OIDC issuers, so your product can configure Pulumi end-to-end on behalf of users.

### How does Truto handle Pulumi's pagination and rate limits?

Truto normalizes Pulumi's cursor-based pagination behind a consistent interface and transparently handles retries and backoff on rate-limited responses, so you work with clean paginated results without implementing Pulumi-specific quirks.