Pulumi Organizations API

openapi: 3.2.0
info:
  description: APIs and Definitions for the Pulumi Cloud product.
  title: Pulumi APIs AccessTokens Organizations API
  version: 1.0.0
servers:
- url: https://api.pulumi.com
  description: Base URL declared by the provider in apis.yml (roadmap#122).
tags:
- name: Organizations
paths:
  /api/change-gates/{orgName}:
    get:
      description: Lists change gates for an entity within the organization. Change gates define approval requirements that must be satisfied before changes can be applied to infrastructure resources. Currently supports listing gates for a single entity specified by entityType and qualifiedName query parameters.
      operationId: ListGates
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The entity type to filter by
        in: query
        name: entityType
        schema:
          type: string
      - description: The fully qualified entity name
        in: query
        name: qualifiedName
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListChangeGatesResponse'
          description: OK
        '400':
          description: invalid query parameter
        '404':
          description: not found
      summary: ListChangeGates
      tags:
      - Organizations
    post:
      description: Creates a new change gate for an entity in the organization. Change gates enforce approval workflows by requiring one or more approvals before infrastructure changes can be applied to the protected resource.
      operationId: CreateGate
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateChangeGateRequest'
        x-originalParamName: body
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChangeGate'
          description: created
        '400':
          description: bad request
        '404':
          description: not found
      summary: CreateChangeGate
      tags:
      - Organizations
  /api/change-gates/{orgName}/{gateID}:
    delete:
      description: Deletes a change gate, removing the approval requirement from the protected entity. Changes to the entity will no longer require approval.
      operationId: DeleteGate
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change gate identifier
        in: path
        name: gateID
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: DeleteChangeGate
      tags:
      - Organizations
    get:
      description: Retrieves the configuration and status of a specific change gate, including its approval requirements and the entity it protects.
      operationId: ReadGate
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change gate identifier
        in: path
        name: gateID
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChangeGate'
          description: OK
        '400':
          description: bad request
        '404':
          description: not found
      summary: ReadChangeGate
      tags:
      - Organizations
    put:
      description: Updates the configuration of an existing change gate, such as modifying its approval requirements or protected entity.
      operationId: UpdateGate
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change gate identifier
        in: path
        name: gateID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateChangeGateRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChangeGate'
          description: OK
        '400':
          description: bad request
        '404':
          description: not found
      summary: UpdateChangeGate
      tags:
      - Organizations
  /api/change-requests/{orgName}:
    get:
      description: Lists change requests for an organization with support for pagination and filtering by entity type and entity ID. Change requests represent proposed infrastructure modifications that require approval before being applied.
      operationId: List_change_requests
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Continuation token for paginated results
        in: query
        name: continuationToken
        schema:
          type: string
      - description: Number of items to return
        in: query
        name: count
        schema:
          format: int64
          type: integer
      - description: The entity identifier to filter by
        in: query
        name: entityId
        schema:
          type: string
      - description: The entity type to filter by
        in: query
        name: entityType
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListChangeRequestsResponse'
          description: OK
        '400':
          description: bad request
        '404':
          description: not found
      summary: ListChangeRequests
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}:
    get:
      description: Retrieves the details of a specific change request, including its current status, description, approvals, and the proposed infrastructure changes.
      operationId: Get
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetChangeRequestResponse'
          description: OK
        '400':
          description: bad request
        '404':
          description: not found
      summary: ReadChangeRequest
      tags:
      - Organizations
    patch:
      description: Updates a change request's metadata. Currently only the description field can be modified after creation.
      operationId: Update
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateChangeRequestRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: UpdateChangeRequest
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/apply:
    post:
      description: Applies an approved change request, triggering the execution of the proposed infrastructure changes. The change request must have received the required number of approvals before it can be applied. Returns 409 if there is a conflict preventing application.
      operationId: Apply
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChangeRequestApplyResult'
          description: OK
        '400':
          description: bad request
        '404':
          description: not found
        '409':
          description: conflict
      summary: ApplyChangeRequest
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/approve:
    delete:
      description: Withdraws a previously given approval for a change request. If the change request no longer has the required number of approvals after withdrawal, it cannot be applied until additional approvals are granted.
      operationId: Unapprove
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UnapproveChangeRequestRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: UnapproveChangeRequest
      tags:
      - Organizations
    post:
      description: Records an approval for a change request from the authenticated user. Once the required number of approvals is met, the change request can be applied.
      operationId: Approve
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApproveChangeRequestRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: ApproveChangeRequest
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/close:
    post:
      description: Closes a change request without applying it. The proposed infrastructure changes are discarded and the request is marked as closed.
      operationId: Close
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloseChangeRequestRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: CloseChangeRequest
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/comments:
    post:
      description: Adds a comment to a change request without approving or closing it. This allows reviewers to provide feedback or ask questions before making a decision.
      operationId: AddComment
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddChangeRequestCommentRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: AddChangeRequestComment
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/events:
    get:
      description: Lists the event log for a change request, including approvals, status changes, and other lifecycle events. Supports pagination via continuation token.
      operationId: ListEvents
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      - description: Continuation token for paginated results
        in: query
        name: continuationToken
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListChangeRequestEventsResponse'
          description: OK
        '400':
          description: invalid query parameter
        '404':
          description: change request events
      summary: ListChangeRequestEvents
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/submit:
    post:
      description: Submits a draft change request for approval. Once submitted, the request enters the review workflow and requires the configured number of approvals before it can be applied.
      operationId: Submit
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SubmitChangeRequestRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: SubmitChangeRequest
      tags:
      - Organizations
  /api/orgs/{orgName}:
    get:
      description: Returns detailed information about the specified organization, including its name, display name, avatar URL, enabled features, subscription tier, and access control settings. The response includes member count, team availability, and other configuration relevant to the caller's role within the organization.
      operationId: GetOrganization
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Organization'
          description: OK
      summary: GetOrganization
      tags:
      - Organizations
    patch:
      description: Updates an organization's settings, such as the default stack permission level for new members, whether members can create teams, and other organization-wide configuration options. Returns the updated organization metadata.
      operationId: UpdateOrganizationSettings
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOrganizationRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationMetadata'
          description: OK
        '400':
          description: Invalid organization settings
      summary: UpdateOrganizationSettings
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs:
    get:
      description: Lists audit log events for an organization. Either continuationToken or startTime is required. Supports filtering by event type and user.
      operationId: ListAuditLogEventsHandlerV1
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Token for paginated result retrieval
        in: query
        name: continuationToken
        schema:
          type: string
      - description: Upper bound of the query range (unix timestamp)
        in: query
        name: endTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by event type
        in: query
        name: eventFilter
        schema:
          type: string
      - description: 'Response format: ''json'' (default)'
        in: query
        name: format
        schema:
          type: string
      - description: Returns entries older than this timestamp (unix timestamp)
        in: query
        name: startTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by username
        in: query
        name: userFilter
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAuditLogs'
          description: OK
        '400':
          description: invalid query params
        '404':
          description: user not found
      summary: ListAuditLogEventsHandlerV1
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/export:
    get:
      description: 'Exports audit log events for an organization in a downloadable format. Audit logs provide an immutable record of all user activity within the organization, including stack operations, member changes, and policy modifications. Results can be filtered by time range, event type, and user. Supported export formats are CSV and CEF (Common Event Format for SIEM integration). Pagination is supported via the continuationToken parameter.


        **Important:** This endpoint differs from other API endpoints:

        - The response is always **gzip compressed**. Use `--compressed` with curl or handle gzip decompression in your client.

        - The `Content-Type: application/json` response header is omitted.


        Note: In V1, startTime specifies the upper bound of the query range. Use the V2 endpoint for more intuitive time range semantics.'
      operationId: ExportAuditLogEventsHandlerV1
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Token for paginated result retrieval
        in: query
        name: continuationToken
        schema:
          type: string
      - description: Upper bound of the query range (unix timestamp)
        in: query
        name: endTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by event type
        in: query
        name: eventFilter
        schema:
          type: string
      - description: 'Response format: ''cef'' or ''csv'' (defaults to csv)'
        in: query
        name: format
        schema:
          type: string
      - description: Returns entries older than this timestamp (unix timestamp)
        in: query
        name: startTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by username
        in: query
        name: userFilter
        schema:
          type: string
      responses:
        '200':
          content:
            text/plain:
              schema:
                type: string
          description: OK
        '400':
          description: Audit Logs is available only to organizations with an Enterprise subscription.
        '404':
          description: user not found
      summary: ExportAuditLogEventsHandlerV1
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/export/config:
    delete:
      description: 'DeleteAuditLogExportConfiguration removes an organization''s audit log export settings.

        Skip feature validation so removal can happen if org no longer has access to feature.'
      operationId: DeleteAuditLogExportConfiguration
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: Organization has not configured audit log export.
      summary: DeleteAuditLogExportConfiguration
      tags:
      - Organizations
    get:
      description: 'GetAuditLogExportConfiguration returns the organization''s current audit log export configuration.

        If the organization has not configured its audit logs for export, returns a 404.'
      operationId: GetAuditLogExportConfiguration
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationAuditLogExportSettings'
          description: OK
        '404':
          description: Audit log export configuration
      summary: GetAuditLogExportConfiguration
      tags:
      - Organizations
    post:
      description: Creates or updates the organization's automated audit log export configuration. Audit log export enables automatic delivery of audit events to an S3 bucket for long-term retention and SIEM integration. The configuration includes the S3 bucket details and IAM role for authentication. This feature is available on Business Critical edition.
      operationId: UpdateAuditLogExportConfiguration
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOrganizationAuditLogExportSettingsRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: Audit log export is not available for this organization.
      summary: UpdateAuditLogExportConfiguration
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/export/config/force:
    post:
      description: 'ForceAuditLogExport exports the audit logs for the organization for a user-supplied timestamp.

        This can be used to backfill data that may have been missed due to an outage or permissions issue.'
      operationId: ForceAuditLogExport
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Unix timestamp to export audit logs for (used for backfilling missed data)
        in: query
        name: timestamp
        schema:
          format: int64
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogExportResult'
          description: OK
        '400':
          description: Audit log export is not available for this organization.
        '404':
          description: Audit log export configuration
      summary: ForceAuditLogExport
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/export/config/test:
    post:
      description: 'TestAuditLogExportConfiguration uses the provided audit log configuration and

        checks if we are able to successfully write some data.'
      operationId: TestAuditLogExportConfiguration
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditLogsExportS3Config'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogExportResult'
          description: OK
        '400':
          description: Audit log export is not available for this organization.
      summary: TestAuditLogExportConfiguration
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/reader-kind:
    get:
      description: 'GetAuditLogsReaderKind returns whether the audit log is being read

        from MySQL or DynamoDB to control the event filtering UI on the front end.'
      operationId: GetAuditLogsReaderKind
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                type: string
          description: OK
      summary: GetAuditLogsReaderKind
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/v2:
    get:
      description: Lists audit log events for an organization. Uses startTime as the lower bound and endTime as the upper bound of the query range. Supports filtering by event type and user.
      operationId: ListAuditLogEventsHandlerV2
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Token for paginated result retrieval
        in: query
        name: continuationToken
        schema:
          type: string
      - description: Upper bound of the query range (unix timestamp)
        in: query
        name: endTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by event type
        in: query
        name: eventFilter
        schema:
          type: string
      - description: 'Response format: ''json'' (default)'
        in: query
        name: format
        schema:
          type: string
      - description: Lower bound of the query range (unix timestamp)
        in: query
        name: startTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by username
        in: query
        name: userFilter
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAuditLogs'
          description: OK
        '400':
          description: invalid query params
        '404':
          description: user not found
      summary: ListAuditLogEventsHandlerV2
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/v2/export:
    get:
      description: Exports audit log events in a downloadable format (CSV or CEF). Supports filtering by time range using startTime (lower bound) and endTime (upper bound), as well as filtering by event type and user.
      operationId: ExportAuditLogEventsHandlerV2
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Token for paginated result retrieval
        in: query
        name: continuationToken
        schema:
          type: string
      - description: Upper bound of the query range (unix timestamp)
        in: query
        name: endTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by event type
        in: query
        name: eventFilter
        schema:
          type: string
      - description: 'Response format: ''cef'' or ''csv'' (defaults to csv)'
        in: query
        name: format
        schema:
          type: string
      - description: Lower bound of the query range (unix timestamp)
        in: query
        name: startTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by username
        in: query
        name: userFilter
        schema:
          type: string
      responses:
        '200':
          content:
            text/plain:
              schema:
                type: string
          description: OK
        '400':
          description: Audit Logs is available only to organizations with an Enterprise subscription.
        '404':
          description: user not found
      summary: ExportAuditLogEventsHandlerV2
      tags:
      - Organizations
  /api/orgs/{orgName}/auth/policies/oidcissuers/{issuerId}:
    get:
      description: Returns the authentication policy associated with a specific OIDC issuer registration. Authentication policies define rules for how OIDC tokens from the issuer are validated and what access they grant, including claim mappings and trust conditions.
      operationId: GetAuthPolicy
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The OIDC issuer identifier
        in: path
        name: issuerId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthPolicy'
          description: OK
        '400':
          description: Invalid issuer ID
      summary: GetAuthPolicy
      tags:
      - Organizations
  /api/orgs/{orgName}/auth/policies/{policyId}:
    patch:
      description: 'Updates an authentication policy for an organization. Authentication policies define rules for how OIDC tokens are validated and what access they grant, including claim mappings, trust conditions, and role assignments. The policy definition cannot be empty.


        The request body contains a `policies` array where each policy object includes:

        - `decision`: `allow` or `deny`

        - `tokenType`: `organization`, `team`, `personal`, or `runner`

        - `teamName`: required when tokenType is `team`

        - `userLogin`: required when tokenType is `personal`

        - `runnerID`: required when tokenType is `runner`

        - `authorizedPermissions`: array of permissions (only `admin` is supported for organization tokens)

        - `rules`: object defining claim-matching rules for the token


        For more information about authorization rules, refer to the [OIDC authorization policies documentation](https://www.pulumi.com/docs/pulumi-cloud/access-management/oidc/client/#configure-the-authorization-policies).'
      operationId: UpdateAuthPolicy
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema

# --- truncated at 32 KB (404 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/pulumi/refs/heads/main/openapi/pulumi-organizations-api-openapi.yml