openapi: 3.0.3
info:
  description: APIs and Definitions for the Pulumi Cloud product.
  title: Pulumi APIs AccessTokens Organizations API
  version: 1.0.0
tags:
- name: Organizations
paths:
  /api/change-gates/{orgName}:
    get:
      description: Lists change gates for an entity within the organization. Change gates define approval requirements that must be satisfied before changes can be applied to infrastructure resources. Currently supports listing gates for a single entity specified by entityType and qualifiedName query parameters.
      operationId: ListGates
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The entity type to filter by
        in: query
        name: entityType
        schema:
          type: string
      - description: The fully qualified entity name
        in: query
        name: qualifiedName
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListChangeGatesResponse'
          description: OK
        '400':
          description: invalid query parameter
        '404':
          description: not found
      summary: ListChangeGates
      tags:
      - Organizations
    post:
      description: Creates a new change gate for an entity in the organization. Change gates enforce approval workflows by requiring one or more approvals before infrastructure changes can be applied to the protected resource.
      operationId: CreateGate
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateChangeGateRequest'
        x-originalParamName: body
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChangeGate'
          description: created
        '400':
          description: bad request
        '404':
          description: not found
      summary: CreateChangeGate
      tags:
      - Organizations
  /api/change-gates/{orgName}/{gateID}:
    delete:
      description: Deletes a change gate, removing the approval requirement from the protected entity. Changes to the entity will no longer require approval.
      operationId: DeleteGate
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change gate identifier
        in: path
        name: gateID
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: DeleteChangeGate
      tags:
      - Organizations
    get:
      description: Retrieves the configuration and status of a specific change gate, including its approval requirements and the entity it protects.
      operationId: ReadGate
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change gate identifier
        in: path
        name: gateID
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChangeGate'
          description: OK
        '400':
          description: bad request
        '404':
          description: not found
      summary: ReadChangeGate
      tags:
      - Organizations
    put:
      description: Updates the configuration of an existing change gate, such as modifying its approval requirements or protected entity.
      operationId: UpdateGate
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change gate identifier
        in: path
        name: gateID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateChangeGateRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChangeGate'
          description: OK
        '400':
          description: bad request
        '404':
          description: not found
      summary: UpdateChangeGate
      tags:
      - Organizations
  /api/change-requests/{orgName}:
    get:
      description: Lists change requests for an organization with support for pagination and filtering by entity type and entity ID. Change requests represent proposed infrastructure modifications that require approval before being applied.
      operationId: List_change_requests
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Continuation token for paginated results
        in: query
        name: continuationToken
        schema:
          type: string
      - description: Number of items to return
        in: query
        name: count
        schema:
          format: int64
          type: integer
      - description: The entity identifier to filter by
        in: query
        name: entityId
        schema:
          type: string
      - description: The entity type to filter by
        in: query
        name: entityType
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListChangeRequestsResponse'
          description: OK
        '400':
          description: bad request
        '404':
          description: not found
      summary: ListChangeRequests
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}:
    get:
      description: Retrieves the details of a specific change request, including its current status, description, approvals, and the proposed infrastructure changes.
      operationId: Get
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetChangeRequestResponse'
          description: OK
        '400':
          description: bad request
        '404':
          description: not found
      summary: ReadChangeRequest
      tags:
      - Organizations
    patch:
      description: Updates a change request's metadata. Currently only the description field can be modified after creation.
      operationId: Update
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateChangeRequestRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: UpdateChangeRequest
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/apply:
    post:
      description: Applies an approved change request, triggering the execution of the proposed infrastructure changes. The change request must have received the required number of approvals before it can be applied. Returns 409 if there is a conflict preventing application.
      operationId: Apply
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ChangeRequestApplyResult'
          description: OK
        '400':
          description: bad request
        '404':
          description: not found
        '409':
          description: conflict
      summary: ApplyChangeRequest
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/approve:
    delete:
      description: Withdraws a previously given approval for a change request. If the change request no longer has the required number of approvals after withdrawal, it cannot be applied until additional approvals are granted.
      operationId: Unapprove
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UnapproveChangeRequestRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: UnapproveChangeRequest
      tags:
      - Organizations
    post:
      description: Records an approval for a change request from the authenticated user. Once the required number of approvals is met, the change request can be applied.
      operationId: Approve
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApproveChangeRequestRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: ApproveChangeRequest
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/close:
    post:
      description: Closes a change request without applying it. The proposed infrastructure changes are discarded and the request is marked as closed.
      operationId: Close
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloseChangeRequestRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: CloseChangeRequest
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/comments:
    post:
      description: Adds a comment to a change request without approving or closing it. This allows reviewers to provide feedback or ask questions before making a decision.
      operationId: AddComment
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddChangeRequestCommentRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: AddChangeRequestComment
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/events:
    get:
      description: Lists the event log for a change request, including approvals, status changes, and other lifecycle events. Supports pagination via continuation token.
      operationId: ListEvents
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      - description: Continuation token for paginated results
        in: query
        name: continuationToken
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListChangeRequestEventsResponse'
          description: OK
        '400':
          description: invalid query parameter
        '404':
          description: change request events
      summary: ListChangeRequestEvents
      tags:
      - Organizations
  /api/change-requests/{orgName}/{changeRequestID}/submit:
    post:
      description: Submits a draft change request for approval. Once submitted, the request enters the review workflow and requires the configured number of approvals before it can be applied.
      operationId: Submit
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The change request identifier
        in: path
        name: changeRequestID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SubmitChangeRequestRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: bad request
        '404':
          description: not found
      summary: SubmitChangeRequest
      tags:
      - Organizations
  /api/orgs/{orgName}:
    get:
      description: Returns detailed information about the specified organization, including its name, display name, avatar URL, enabled features, subscription tier, and access control settings. The response includes member count, team availability, and other configuration relevant to the caller's role within the organization.
      operationId: GetOrganization
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Organization'
          description: OK
      summary: GetOrganization
      tags:
      - Organizations
    patch:
      description: Updates an organization's settings, such as the default stack permission level for new members, whether members can create teams, and other organization-wide configuration options. Returns the updated organization metadata.
      operationId: UpdateOrganizationSettings
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOrganizationRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationMetadata'
          description: OK
        '400':
          description: Invalid organization settings
      summary: UpdateOrganizationSettings
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs:
    get:
      description: Lists audit log events for an organization. Either continuationToken or startTime is required. Supports filtering by event type and user.
      operationId: ListAuditLogEventsHandlerV1
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Token for paginated result retrieval
        in: query
        name: continuationToken
        schema:
          type: string
      - description: Upper bound of the query range (unix timestamp)
        in: query
        name: endTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by event type
        in: query
        name: eventFilter
        schema:
          type: string
      - description: 'Response format: ''json'' (default)'
        in: query
        name: format
        schema:
          type: string
      - description: Returns entries older than this timestamp (unix timestamp)
        in: query
        name: startTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by username
        in: query
        name: userFilter
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAuditLogs'
          description: OK
        '400':
          description: invalid query params
        '404':
          description: user not found
      summary: ListAuditLogEventsHandlerV1
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/export:
    get:
      description: 'Exports audit log events for an organization in a downloadable format. Audit logs provide an immutable record of all user activity within the organization, including stack operations, member changes, and policy modifications. Results can be filtered by time range, event type, and user. Supported export formats are CSV and CEF (Common Event Format for SIEM integration). Pagination is supported via the continuationToken parameter.


        **Important:** This endpoint differs from other API endpoints:

        - The response is always **gzip compressed**. Use `--compressed` with curl or handle gzip decompression in your client.

        - The `Content-Type: application/json` response header is omitted.


        Note: In V1, startTime specifies the upper bound of the query range. Use the V2 endpoint for more intuitive time range semantics.'
      operationId: ExportAuditLogEventsHandlerV1
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Token for paginated result retrieval
        in: query
        name: continuationToken
        schema:
          type: string
      - description: Upper bound of the query range (unix timestamp)
        in: query
        name: endTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by event type
        in: query
        name: eventFilter
        schema:
          type: string
      - description: 'Response format: ''cef'' or ''csv'' (defaults to csv)'
        in: query
        name: format
        schema:
          type: string
      - description: Returns entries older than this timestamp (unix timestamp)
        in: query
        name: startTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by username
        in: query
        name: userFilter
        schema:
          type: string
      responses:
        '200':
          content:
            text/plain:
              schema:
                type: string
          description: OK
        '400':
          description: Audit Logs is available only to organizations with an Enterprise subscription.
        '404':
          description: user not found
      summary: ExportAuditLogEventsHandlerV1
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/export/config:
    delete:
      description: 'DeleteAuditLogExportConfiguration removes an organization''s audit log export settings.

        Skip feature validation so removal can happen if org no longer has access to feature.'
      operationId: DeleteAuditLogExportConfiguration
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: Organization has not configured audit log export.
      summary: DeleteAuditLogExportConfiguration
      tags:
      - Organizations
    get:
      description: 'GetAuditLogExportConfiguration returns the organization''s current audit log export configuration.

        If the organization has not configured its audit logs for export, returns a 404.'
      operationId: GetAuditLogExportConfiguration
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationAuditLogExportSettings'
          description: OK
        '404':
          description: Audit log export configuration
      summary: GetAuditLogExportConfiguration
      tags:
      - Organizations
    post:
      description: Creates or updates the organization's automated audit log export configuration. Audit log export enables automatic delivery of audit events to an S3 bucket for long-term retention and SIEM integration. The configuration includes the S3 bucket details and IAM role for authentication. This feature is available on Business Critical edition.
      operationId: UpdateAuditLogExportConfiguration
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOrganizationAuditLogExportSettingsRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: Audit log export is not available for this organization.
      summary: UpdateAuditLogExportConfiguration
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/export/config/force:
    post:
      description: 'ForceAuditLogExport exports the audit logs for the organization for a user-supplied timestamp.

        This can be used to backfill data that may have been missed due to an outage or permissions issue.'
      operationId: ForceAuditLogExport
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Unix timestamp to export audit logs for (used for backfilling missed data)
        in: query
        name: timestamp
        schema:
          format: int64
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogExportResult'
          description: OK
        '400':
          description: Audit log export is not available for this organization.
        '404':
          description: Audit log export configuration
      summary: ForceAuditLogExport
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/export/config/test:
    post:
      description: 'TestAuditLogExportConfiguration uses the provided audit log configuration and

        checks if we are able to successfully write some data.'
      operationId: TestAuditLogExportConfiguration
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditLogsExportS3Config'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogExportResult'
          description: OK
        '400':
          description: Audit log export is not available for this organization.
      summary: TestAuditLogExportConfiguration
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/reader-kind:
    get:
      description: 'GetAuditLogsReaderKind returns whether the audit log is being read

        from MySQL or DynamoDB to control the event filtering UI on the front end.'
      operationId: GetAuditLogsReaderKind
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                type: string
          description: OK
      summary: GetAuditLogsReaderKind
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/v2:
    get:
      description: Lists audit log events for an organization. Uses startTime as the lower bound and endTime as the upper bound of the query range. Supports filtering by event type and user.
      operationId: ListAuditLogEventsHandlerV2
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Token for paginated result retrieval
        in: query
        name: continuationToken
        schema:
          type: string
      - description: Upper bound of the query range (unix timestamp)
        in: query
        name: endTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by event type
        in: query
        name: eventFilter
        schema:
          type: string
      - description: 'Response format: ''json'' (default)'
        in: query
        name: format
        schema:
          type: string
      - description: Lower bound of the query range (unix timestamp)
        in: query
        name: startTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by username
        in: query
        name: userFilter
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResponseAuditLogs'
          description: OK
        '400':
          description: invalid query params
        '404':
          description: user not found
      summary: ListAuditLogEventsHandlerV2
      tags:
      - Organizations
  /api/orgs/{orgName}/auditlogs/v2/export:
    get:
      description: Exports audit log events in a downloadable format (CSV or CEF). Supports filtering by time range using startTime (lower bound) and endTime (upper bound), as well as filtering by event type and user.
      operationId: ExportAuditLogEventsHandlerV2
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Token for paginated result retrieval
        in: query
        name: continuationToken
        schema:
          type: string
      - description: Upper bound of the query range (unix timestamp)
        in: query
        name: endTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by event type
        in: query
        name: eventFilter
        schema:
          type: string
      - description: 'Response format: ''cef'' or ''csv'' (defaults to csv)'
        in: query
        name: format
        schema:
          type: string
      - description: Lower bound of the query range (unix timestamp)
        in: query
        name: startTime
        schema:
          format: int64
          type: integer
      - description: Filter audit logs by username
        in: query
        name: userFilter
        schema:
          type: string
      responses:
        '200':
          content:
            text/plain:
              schema:
                type: string
          description: OK
        '400':
          description: Audit Logs is available only to organizations with an Enterprise subscription.
        '404':
          description: user not found
      summary: ExportAuditLogEventsHandlerV2
      tags:
      - Organizations
  /api/orgs/{orgName}/auth/policies/oidcissuers/{issuerId}:
    get:
      description: Returns the authentication policy associated with a specific OIDC issuer registration. Authentication policies define rules for how OIDC tokens from the issuer are validated and what access they grant, including claim mappings and trust conditions.
      operationId: GetAuthPolicy
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The OIDC issuer identifier
        in: path
        name: issuerId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthPolicy'
          description: OK
        '400':
          description: Invalid issuer ID
      summary: GetAuthPolicy
      tags:
      - Organizations
  /api/orgs/{orgName}/auth/policies/{policyId}:
    patch:
      description: 'Updates an authentication policy for an organization. Authentication policies define rules for how OIDC tokens are validated and what access they grant, including claim mappings, trust conditions, and role assignments. The policy definition cannot be empty.


        The request body contains a `policies` array where each policy object includes:

        - `decision`: `allow` or `deny`

        - `tokenType`: `organization`, `team`, `personal`, or `runner`

        - `teamName`: required when tokenType is `team`

        - `userLogin`: required when tokenType is `personal`

        - `runnerID`: required when tokenType is `runner`

        - `authorizedPermissions`: array of permissions (only `admin` is supported for organization tokens)

        - `rules`: object defining claim-matching rules for the token


        For more information about authorization rules, refer to the [OIDC authorization policies documentation](https://www.pulumi.com/docs/pulumi-cloud/access-management/oidc/client/#configure-the-authorization-policies).'
      operationId: UpdateAuthPolicy
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy identifier
        in: path
        name: policyId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuthPolicyUpdateRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthPolicy'
          description: OK
        '400':
          description: policy definition can not be empty
      summary: UpdateAuthPolicy
      tags:
      - Organizations
  /api/orgs/{orgName}/bulk-transfer/stacks:
    post:
      description: 'TransferAllStacks transfers all active stacks from one org to another, where deleted stacks

        will be skipped/ignored. We are currently constraining usage of this function to organizations

        with less than or equal to TransferAllStacksMax stacks.


        NOTE: This operation will lock the organization while the transfer is in-progress, to

        rewrite all checkpoint files that use service-managed secrets. This means that the

        organization will be read-only and no stack updates can begin until the rename process

        has completed.'
      operationId: TransferAllStacks
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TransferAllStacksRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                type: string
          description: OK
      summary: TransferAllStacks
      tags:
      - Organizations
  /api/orgs/{orgName}/cmk:
    get:
      description: Returns all customer managed keys (CMK) configured for an organization, including their key identifiers, cloud provider details, enabled status, and which key is set as the default for new stacks.
      operationId: ListOrganizationKeys
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/CustomerManagedKey'
                type: array
          description: successful operation
      summary: ListOrganizationKeys
      tags:
      - Organizations
    post:
      description: Creates a new customer managed key (CMK) for an organization, allowing the organization to use their own encryption keys for securing secrets stored in Pulumi Cloud. The key must be a valid cloud provider key (e.g., AWS KMS). Once created, the key can be set as the default encryption key for all new stacks in the organization.
      operationId: CreateOrganizationKey
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CustomerManagedKeyInput'
        x-originalParamName: body
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomerManagedKey'
          description: Created
        '400':
          description: Invalid key provided
      summary: CreateOrganizationKey
      tags:
      - Organizations
  /api/orgs/{orgName}/cmk/disable:
    post:
      description: Disables all customer managed keys (CMK) for an organization, reverting to Pulumi-managed encryption for secrets. After disabling, new stacks will use the default Pulumi-managed encryption rather than customer-provided keys.
      operationId: DisableAllOrganizationKeys
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
        '400':
          description: Organization does not have customer managed keys
      summary: DisableAllOrganizationKeys
      tags:
      - Organizations
  /api/orgs/{orgName}/cmk/migration:
    get:
      description: Returns all key encryption key (KEK) migrations for an organization. KEK migrations track the process of re-encrypting secrets when rotating customer managed keys. Each migration record includes the source and destination keys, status, and any errors encountered during the migration process.
      operationId: ListOrganizationKeyMigrations
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/KeyEncryptionKeyMigration'
                type: array
          description: successful operation
      summary: ListOrganizationKeyMigrations
      tags:
      - Organizations
  /api/orgs/{orgName}/cmk/migration/retry:
    post:
      description: Retries any failed key encryption key (KEK) migrations for an organization. KEK migrations can fail due to transient errors when re-encrypting secrets during customer managed key rotation. This endpoint re-attempts the failed migrations without restarting the entire process.
      operationId: RetryOrganizationKeyMigrations
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
      summary: RetryOrganizationKeyMigrations
      tags:
      - Organizations
  /api/orgs/{orgName}/cmk/{keyID}/default:
    post:
      description: Sets a customer managed key as the default encryption key for the organization. New stacks created in the organization will use this key for encrypting secrets by default. The key must already be created and enabled for the organization.
      operationId: SetDefaultOrganizationKey
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The key identifier
        in: path
        name: keyID
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
        '404':
          description: Organization or Key not found
      summary: SetDefaultOrganizationKey
      tags:
      - Organizations
  /api/orgs/{orgName}/cmk/{keyID}/disable:
    post:
      description: Disables a specific customer managed key (CMK) for an organization. The key can no longer be used for encrypting new secrets, but existing secrets encrypted with this key remain accessible.
      operationId: DisableOrganizationKey
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The key identifier
        in: path
        name: keyID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DisableCustomerManagedKeyRequest'
        x-originalParamName: body
      responses:
        '200':
          description: OK
        '400':
          description: Invalid key provided
        '404':
          description: Organization or Key not found
      summary: DisableOrganizationKey
      tags:
      - Organizations
  /api/orgs/{orgName}/discovered-resources/summary:
    get:
      description: 'GetUsageSummaryDiscoveredResourceHours handles request to fetch the summary

        of discovered resources for an organization.'
      operationId: GetUsageSummaryDiscoveredResourceHours
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Time granularity for aggregation (e.g., 'hourly', 'daily', 'monthly')
        in: query
        name: granularity
        schema:
          type: string
      - description: Number of days to look back from the current time or lookbackStart
        in: query
        name: lookbackDays
        schema:
          format: int64
          type: integer
      - description: Unix timestamp for the start of the lookback period (defaults to current time if omitted)
        in: query
        name: lookbackStart
        schema:
          format: int64
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetResourceCountSummaryResponse'
          description: OK
        '204':
          description: No Content
      summary: GetUsageSummaryDiscoveredResourceHours
      tags:
      - Organizations
  /api/orgs/{orgName}/hooks:
    get:
      description: Returns all webhooks configured at the organization level. Each webhook in the response includes its name, destination URL, format (generic JSON, Slack, or Microsoft Teams), active status, and subscribed event filters. Organization-level webhooks can fire on stack lifecycle events, deployment events, drift detection events, and policy violation events.
      operationId: ListOrganizationWebhooks
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/WebhookResponse'
                type: array
          description: successful operation
      summary: ListOrganizationWebhooks
      tags:
      - Organizations
    post:
      description: 'Creates a new webhook for an organization to notify external services when events occur. Webhooks can be configured to fire on stack events (created, deleted, update succeeded/failed), deployment events (queued, started, succeeded, failed), drift detection events, and policy violation events (mandatory, advisory).


        The `format` field accepts: `raw` (default), `slack`, `ms_teams`, or `pulumi_deployments`.


        The `filters` field accepts a list of event types to subscribe to. See the [webhook event filtering documentation](https://www.pulumi.com/docs/pulumi-cloud/webhooks/#event-filtering) for available filters.


        The optional `secret` field sets the HMAC key for signature verification via the `Pulumi-Webhook-Signature` header. See the [webhook headers documentation](https://www.pulumi.com/docs/pulumi-cloud/webhooks/#headers) for details.'
      operationId: CreateOrganizationWebhook
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Webhook'
        x-originalParamName: body
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookResponse'
          description: Created
        '400':
          description: Organization name from request body doesn't match URL.
        '409':
          description: Webhook with this name already exists
      summary: CreateOrganizationWebhook
      tags:
      - Organizations
  /api/orgs/{orgName}/hooks/{hookName}:
    delete:
      description: Permanently deletes an organization-level webhook. The webhook will no longer receive event notifications for stack updates, deployments, drift detection, or policy violations. This action cannot be undone.
      operationId: DeleteOrganizationWebhook
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The webhook name identifier
        in: path
        name: hookName
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
      summary: DeleteOrganizationWebhook
      tags:
      - Organizations
    get:
      description: Returns the configuration of a specific organization-level webhook, including its name, destination URL, format (generic JSON, Slack, or Microsoft Teams), active status, event filter subscriptions, and whether a shared secret is configured for HMAC signature verification.
      operationId: GetOrganizationWebhook
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The webhook name identifier
        in: path
        name: hookName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookResponse'
          description: OK
        '404':
          description: Webhook
      summary: GetOrganizationWebhook
      tags:
      - Organizations
    patch:
      description: Updates an existing organization-level webhook's configuration, including its destination URL, format, active status, event filter subscriptions, and shared secret. The 'pulumi_deployments' format can only be used on stack or environment webhooks, not organization-level ones.
      operationId: UpdateOrganizationWebhook
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The webhook name identifier
        in: path
        name: hookName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Webhook'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookResponse'
          description: OK
        '400':
          description: '''pulumi_deployments'' format can only be used on stack or environment webhooks.'
        '404':
          description: Webhook
      summary: UpdateOrganizationWebhook
      tags:
      - Organizations
  /api/orgs/{orgName}/hooks/{hookName}/deliveries:
    get:
      description: Returns the recent delivery history for a specific webhook, including the HTTP status code, response time, request payload, and delivery timestamp for each attempt. This allows monitoring webhook health and diagnosing delivery failures. Each delivery includes a unique Pulumi-Webhook-ID.
      operationId: GetOrganizationWebhookDeliveries
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The webhook name identifier
        in: path
        name: hookName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/WebhookDelivery'
                type: array
          description: successful operation
      summary: GetOrganizationWebhookDeliveries
      tags:
      - Organizations
  /api/orgs/{orgName}/hooks/{hookName}/deliveries/{event}/redeliver:
    post:
      description: 'Triggers the Pulumi Service to redeliver

        a specific event to a webhook. For example, to resend an event that the

        hook failed to process the first time.'
      operationId: RedeliverOrganizationWebhookEvent
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The webhook name identifier
        in: path
        name: hookName
        required: true
        schema:
          type: string
      - description: The event identifier to redeliver
        in: path
        name: event
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookDelivery'
          description: OK
        '404':
          description: Webhook
      summary: RedeliverOrganizationWebhookEvent
      tags:
      - Organizations
  /api/orgs/{orgName}/hooks/{hookName}/ping:
    post:
      description: 'Sends a test ping to an organization webhook to validate that it is working.

        This function bypasses the message queue machinery and issues the request directly to the webhook.'
      operationId: PingOrganizationWebhook
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The webhook name identifier
        in: path
        name: hookName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookDelivery'
          description: OK
        '404':
          description: Webhook
      summary: PingOrganizationWebhook
      tags:
      - Organizations
  /api/orgs/{orgName}/members:
    get:
      description: "ListOrganizationMembers lists the members of an organization. This API unfortunately has two different\n\"modes\", returning either the organization's \"frontend members\" or \"backend members\".\n\n  - A \"frontend member\" is data stored in the Pulumi Service's database. For organizations billed\n    per-member, this is the set of members that are counted against the organization's seat cap.\n  - A \"backend member\" is data stored in the organization's backend. (e.g. GitHub, GitLab, or for SAML\n    orgs, also the Pulumi Service database.)\n\nThis isn't ideal, but is required so that the APIs can be paginated correctly while not returning any\nusers twice. (Which would be impossible in some cases.)"
      operationId: ListOrganizationMembers
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Token for paginated result retrieval
        in: query
        name: continuationToken
        schema:
          type: string
      - description: 'Member type to list: ''frontend'' for Pulumi Service members or ''backend'' for organization backend members'
        in: query
        name: type
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListOrganizationMembersResponse'
          description: OK
        '400':
          description: invalid query parameter
      summary: ListOrganizationMembers
      tags:
      - Organizations
  /api/orgs/{orgName}/members/{userLogin}:
    delete:
      description: Removes a user from an organization. The removed user loses access to all organization resources including stacks, teams, and projects. The caller cannot remove themselves from the organization. The user is also removed from all teams they belong to within the organization.
      operationId: DeleteOrganizationMember
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The user login name
        in: path
        name: userLogin
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: You cannot remove yourself from the organization.
        '404':
          description: User
      summary: DeleteOrganizationMember
      tags:
      - Organizations
    patch:
      description: Modifies a user's role within an organization. Set `role` to assign a built-in role (`member`, `admin`, or `billingManager`), or set `fgaRoleId` to assign a custom role. If both are provided, `fgaRoleId` takes precedence.
      operationId: UpdateOrganizationMember
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The user login name
        in: path
        name: userLogin
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOrganizationMemberRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: Invalid parameter 'roleID'.
        '404':
          description: User
      summary: UpdateOrganizationMember
      tags:
      - Organizations
    post:
      description: 'Adds an existing Pulumi user to an organization with a built-in role. **Important:** The user must have already signed up for a Pulumi account before they can be added to an organization.


        This endpoint only assigns built-in roles. To onboard a user with a custom role, use the organization invite flow (`BatchCreateOrgInviteEmail`) and set `roleId` on the invite — the custom role is applied when the user accepts. Alternatively, add the user here with a built-in role and then call `UpdateOrganizationMember` with `fgaRoleId` to reassign.


        Returns the newly created organization member record. Returns 409 if the user is already a member of the organization.'
      operationId: AddOrganizationMember
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The user login name
        in: path
        name: userLogin
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddOrganizationMemberRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationMember'
          description: OK
        '400':
          description: Invalid organization role.
        '404':
          description: User
        '409':
          description: User is already an organization member.
      summary: AddOrganizationMember
      tags:
      - Organizations
  /api/orgs/{orgName}/members/{userLogin}/set-admin:
    post:
      description: 'Promotes a member to administrator on organizations that are limited to a single admin. This endpoint is only valid for Team subscriptions (Team Starter and Team Growth) — it returns 400 on any other plan. On these plans, `UpdateOrganizationMember` cannot promote a member to admin, because doing so would require simultaneously demoting the current admin. This endpoint performs both changes atomically: the caller (who must be the current sole admin) is demoted to member and the target user is promoted to admin.


        **Note:** This endpoint operates on built-in roles only and does not integrate with custom roles.'
      operationId: SetSoleOrganizationAdmin
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The user login name
        in: path
        name: userLogin
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: Wrong API. Use the regular update Pulumi organization member endpoint instead.
        '404':
          description: User
      summary: SetSoleOrganizationAdmin
      tags:
      - Organizations
  /api/orgs/{orgName}/metadata:
    get:
      description: 'GetOrganizationMetadata returns metadata about the given organization. This is

        designed to be an inexpensive call.'
      operationId: GetOrganizationMetadata
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationMetadata'
          description: OK
      summary: GetOrganizationMetadata
      tags:
      - Organizations
  /api/orgs/{orgName}/oidc/issuers:
    get:
      description: Returns all OIDC issuer registrations for an organization. OIDC issuer registrations establish trust relationships with external identity providers (such as AWS, Azure, Google Cloud, or GitHub Actions) to enable token exchange for temporary Pulumi Cloud credentials. This eliminates the need for long-lived access tokens in CI/CD pipelines and deployment automation.
      operationId: List_orgs_oidc_issuers
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListOidcIssuersResponse'
          description: OK
      summary: List
      tags:
      - Organizations
    post:
      description: Registers a new OIDC issuer for an organization, establishing a trust relationship with an external identity provider. Once registered, the identity provider can issue signed, short-lived tokens that are exchanged for temporary Pulumi Cloud credentials during deployments. This eliminates the need to store long-lived access tokens. Supported providers include AWS, Azure, Google Cloud, GitHub Actions, and any OIDC-compliant identity provider. The request must include the issuer URL, and the service will fetch the provider's public signing keys to verify token authenticity.
      operationId: RegisterOidcIssuer
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OidcIssuerRegistrationRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OidcIssuerRegistrationResponse'
          description: OK
        '400':
          description: metadata object store endpoint is not configured
      summary: RegisterOidcIssuer
      tags:
      - Organizations
  /api/orgs/{orgName}/oidc/issuers/{issuerId}:
    delete:
      description: Deletes an OIDC issuer registration from an organization, removing the trust relationship between the organization and the identity provider. After deletion, tokens issued by this provider can no longer be exchanged for temporary Pulumi Cloud credentials. Any deployments or automation relying on this OIDC issuer for authentication will stop working.
      operationId: DeleteOidcIssuer
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The OIDC issuer identifier
        in: path
        name: issuerId
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '404':
          description: oidc issuer
      summary: DeleteOidcIssuer
      tags:
      - Organizations
    get:
      description: Returns the details of a specific OIDC issuer registration, including the issuer URL, audience restrictions, TLS thumbprints, and trust policy configuration. OIDC issuer registrations establish trust relationships between the organization and external identity providers, enabling token exchange for temporary Pulumi Cloud credentials without storing long-lived secrets.
      operationId: GetOidcIssuer
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The OIDC issuer identifier
        in: path
        name: issuerId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OidcIssuerRegistrationResponse'
          description: OK
        '404':
          description: oidc issuer
      summary: GetOidcIssuer
      tags:
      - Organizations
    patch:
      description: Updates an existing OIDC issuer registration for an organization. This can be used to modify the issuer name, audience restrictions, trust policies, or other configuration. The issuer URL itself cannot be changed after creation. The issuer name is required in the update request.
      operationId: UpdateOidcIssuer
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The OIDC issuer identifier
        in: path
        name: issuerId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OidcIssuerUpdateRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OidcIssuerRegistrationResponse'
          description: OK
        '400':
          description: the issuer name is required
        '404':
          description: oidc issuer
      summary: UpdateOidcIssuer
      tags:
      - Organizations
  /api/orgs/{orgName}/oidc/issuers/{issuerId}/regenerate-thumbprints:
    post:
      description: Regenerates the TLS certificate thumbprints for an OIDC issuer by re-fetching the issuer's public keys. This is needed when the identity provider rotates its TLS certificates. Cannot be used if the issuer's JWKS are statically configured.
      operationId: RegenerateThumbprints
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The OIDC issuer identifier
        in: path
        name: issuerId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OidcIssuerRegistrationResponse'
          description: OK
        '400':
          description: issuer jwks are statically configured, can't regenerate thumbprints
        '404':
          description: oidc issuer
      summary: RegenerateThumbprints
      tags:
      - Organizations
  /api/orgs/{orgName}/packages/usage:
    get:
      description: Returns the stacks within an organization that use a specific Pulumi package, helping track package adoption and identify affected stacks when planning package upgrades or deprecations.
      operationId: GetPackageUsedByStacks
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The continuation token
        in: query
        name: continuationToken
        schema:
          type: string
      - description: Maximum number of results to return per page. Defaults to 100, maximum 500.
        in: query
        name: limit
        schema:
          format: int64
          type: integer
      - description: The package name
        in: query
        name: packageName
        schema:
          type: string
      - description: Filter to stacks using this specific version. If omitted, returns stacks using any version.
        in: query
        name: version
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PackageUsageResponse'
          description: OK
        '400':
          description: 'missing required query param: packageName'
        '404':
          description: Package or organization not found
      summary: GetPackageUsedByStacks
      tags:
      - Organizations
  /api/orgs/{orgName}/policygroups:
    get:
      description: Returns a list of all Policy Groups for the organization. Policy Groups define which Policy Packs are enforced on which stacks, with configurable enforcement levels (advisory, mandatory, or disabled) per pack. Every organization has a default Policy Group, and additional groups can be created to apply different policy sets to different environments (e.g., stricter enforcement in production).
      operationId: ListPolicyGroups
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppListPolicyGroupsResponse'
          description: OK
        '404':
          description: Organization not found
      summary: ListPolicyGroups
      tags:
      - Organizations
    post:
      description: Creates a new Policy Group for an organization. Policy Groups define which Policy Packs are enforced on which stacks or cloud accounts, with configurable enforcement levels (advisory, mandatory, or disabled) per pack. This allows different policy strictness for different environments, such as advisory-only in development and mandatory in production.
      operationId: NewPolicyGroup
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NewPolicyGroupRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: Invalid entity type or invalid Policy Group name
        '404':
          description: Organization not found
        '409':
          description: Policy Group already exists
      summary: NewPolicyGroup
      tags:
      - Organizations
  /api/orgs/{orgName}/policygroups/metadata:
    get:
      description: Returns high-level policy protection metrics for an organization, including the number of stacks protected by policy enforcement, the total number of Policy Groups, and overall policy coverage statistics.
      operationId: GetPolicyGroupMetadata
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyGroupMetadata'
          description: OK
        '404':
          description: Organization not found
      summary: GetPolicyGroupMetadata
      tags:
      - Organizations
  /api/orgs/{orgName}/policygroups/{policyGroup}:
    delete:
      description: Deletes a Policy Group from an organization. A Policy Group defines which Policy Packs are enforced on which stacks, with configurable enforcement levels (advisory, mandatory, or disabled) per pack. The organization's default Policy Group cannot be deleted. Deleting a Policy Group removes all policy enforcement associations for the stacks that were assigned to it.
      operationId: DeletePolicyGroup
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy group name
        in: path
        name: policyGroup
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: Cannot delete the default Policy Group
        '404':
          description: Organization or Policy Group not found
      summary: DeletePolicyGroup
      tags:
      - Organizations
    get:
      description: Returns the details of a specific Policy Group, including the list of Policy Packs applied to it and their enforcement levels (advisory, mandatory, or disabled), as well as the stacks or cloud accounts assigned to the group. Policy Groups enable targeted policy enforcement by associating sets of policies with specific infrastructure resources.
      operationId: GetPolicyGroup
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy group name
        in: path
        name: policyGroup
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyGroup'
          description: OK
        '404':
          description: Organization or Policy Group not found
      summary: GetPolicyGroup
      tags:
      - Organizations
    patch:
      description: 'Updates a Policy Group''s configuration. This multi-purpose endpoint supports several operations in a single request via different body fields:


        - `newName`: rename the policy group

        - `addStack` / `removeStack`: add or remove stacks (with `name` and `routingProject` fields)

        - `addPolicyPack` / `removePolicyPack`: add or remove policy packs (with `name`, `version`, `versionTag`, and optional `config`)

        - `addInsightsAccount` / `removeInsightsAccount`: add or remove Insights accounts


        Enforcement levels for policy packs are `advisory`, `mandatory`, or `disabled`.'
      operationId: UpdatePolicyGroup
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy group name
        in: path
        name: policyGroup
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdatePolicyGroupRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
        '404':
          description: Organization, Policy Group, Stack, Account, or Policy Pack not found
      summary: UpdatePolicyGroup
      tags:
      - Organizations
  /api/orgs/{orgName}/policygroups/{policyGroup}/batch:
    patch:
      description: BatchUpdatePolicyGroup applies multiple update operations to the Policy Group efficiently. Each operation in the list uses the same fields as UpdatePolicyGroupRequest. Operations are grouped by type (adds, removes) and processed in batches for efficiency.
      operationId: BatchUpdatePolicyGroup
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy group name
        in: path
        name: policyGroup
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              items:
                $ref: '#/components/schemas/UpdatePolicyGroupRequest'
              type: array
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: Bad Request
        '404':
          description: Organization, Policy Group, Stack, Account, or Policy Pack not found
      summary: BatchUpdatePolicyGroup
      tags:
      - Organizations
  /api/orgs/{orgName}/policypacks:
    get:
      description: 'ListPolicyPacks returns a list of all complete Policy Packs for the organization.

        If the `policypack` query parameter is set, it will only list the policy

        packs with the specified name.'
      operationId: ListPolicyPacks_orgs
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy pack name
        in: query
        name: policypack
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppListPolicyPacksResponse'
          description: OK
        '400':
          description: invalid query parameter
      summary: ListPolicyPacks
      tags:
      - Organizations
    post:
      description: Creates a new Policy Pack for an organization. A Policy Pack is a versioned collection of related policies that validate infrastructure configuration during deployments. Policies can enforce rules such as requiring encryption on storage buckets or prohibiting public access to databases. The pack must contain at least one policy. Once created, the pack can be applied to Policy Groups to enforce rules on specific stacks with configurable enforcement levels (advisory, mandatory, or disabled).
      operationId: CreatePolicyPack
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AppCreatePolicyPackRequest'
        x-originalParamName: body
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppCreatePolicyPackResponse'
          description: Created
        '400':
          description: Policy Pack must have at least one policy.
      summary: CreatePolicyPack
      tags:
      - Organizations
  /api/orgs/{orgName}/policypacks/{policyPackName}:
    delete:
      description: 'DeletePolicyPack deletes all versions of a Policy Pack, the associated

        packs stored in S3, and any applied versions of the Policy Packs.'
      operationId: DeletePolicyPack_orgs_policypacks
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy pack name
        in: path
        name: policyPackName
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
        '400':
          description: Cannot delete an enabled Policy Pack
        '404':
          description: Policy Pack
      summary: DeletePolicyPack
      tags:
      - Organizations
  /api/orgs/{orgName}/policypacks/{policyPackName}/versions/{version}:
    delete:
      description: 'DeletePolicyPackVersion deletes a specific version of a Policy Pack and deletes

        the associated pack stored in S3. A Policy Pack must be unapplied to be deleted.'
      operationId: DeletePolicyPackVersion
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy pack name
        in: path
        name: policyPackName
        required: true
        schema:
          type: string
      - description: The version number
        in: path
        name: version
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
        '400':
          description: Cannot delete external policy packs
        '404':
          description: Organization or Policy Pack not found
        '409':
          description: Cannot delete a Policy Pack that is applied to Policy Groups
      summary: DeletePolicyPackVersion
      tags:
      - Organizations
    get:
      description: Returns the metadata and list of individual policies for a specific version of a Policy Pack. Each policy includes its name, description, enforcement level (advisory, mandatory, or disabled), and configuration schema. Returns 400 if the Policy Pack version is not yet complete (still being uploaded), or 404 if the organization or pack is not found.
      operationId: GetPolicyPack
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy pack name
        in: path
        name: policyPackName
        required: true
        schema:
          type: string
      - description: The version number
        in: path
        name: version
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppGetPolicyPackResponse'
          description: OK
        '400':
          description: Cannot get incomplete Policy Pack
        '404':
          description: Organization or Policy Pack not found
      summary: GetPolicyPack
      tags:
      - Organizations
  /api/orgs/{orgName}/policypacks/{policyPackName}/versions/{version}/complete:
    post:
      description: 'Transitions the publish status of a specific Policy Pack version to ''complete'', making it available for enforcement. Policy Packs go through a multi-step publish process: first the pack content is uploaded, then this endpoint is called to finalize publication. Returns 400 if the pack is already complete.'
      operationId: CompletePolicyPack
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy pack name
        in: path
        name: policyPackName
        required: true
        schema:
          type: string
      - description: The version number
        in: path
        name: version
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: Policy Pack is already complete
        '404':
          description: Organization or Policy Pack not found
      summary: CompletePolicyPack
      tags:
      - Organizations
  /api/orgs/{orgName}/policypacks/{policyPackName}/versions/{version}/schema:
    get:
      description: Returns the JSON configuration schema for a specific version of a Policy Pack. The schema defines the configurable parameters for each policy in the pack, including allowed values, defaults, and validation rules. Policy Groups use this schema to configure policy behavior when assigning packs to stacks.
      operationId: GetPolicyPackConfigSchema
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy pack name
        in: path
        name: policyPackName
        required: true
        schema:
          type: string
      - description: The version number
        in: path
        name: version
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppGetPolicyPackConfigSchemaResponse'
          description: OK
        '400':
          description: Policy as code feature not enabled
        '404':
          description: Organization or Policy Pack not found
      summary: GetPolicyPackConfigSchema
      tags:
      - Organizations
  /api/orgs/{orgName}/policyresults/compliance:
    post:
      description: Returns compliance results for policy issues grouped by entity. The grouping can be by stack, cloud account, or severity, providing different views of the organization's policy compliance posture. This powers the compliance dashboard in the Pulumi Cloud console.
      operationId: GetPolicyComplianceResults
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetPolicyComplianceResultsRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetPolicyComplianceResultsResponse'
          description: OK
        '400':
          description: Invalid entity parameter. Must be 'stack', 'account', or 'severity'
        '404':
          description: Organization not found
      summary: GetPolicyComplianceResults
      tags:
      - Organizations
  /api/orgs/{orgName}/policyresults/issues:
    post:
      description: Returns all policy issues for an organization with support for pagination and advanced filtering via the grid request format. Policy issues represent violations detected by Policy Packs during stack updates or continuous compliance scans. Each issue includes the violating resource, policy details, enforcement level (advisory or mandatory), severity, and triage status.
      operationId: ListPolicyIssues
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AngularGridGetRowsRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPolicyIssuesResponse'
          description: OK
        '400':
          description: Invalid filter parameters
        '404':
          description: Organization not found
      summary: ListPolicyIssues
      tags:
      - Organizations
  /api/orgs/{orgName}/policyresults/issues/export:
    post:
      description: Exports policy issues for an organization to CSV format for offline analysis or reporting. Policy issues represent violations detected by Policy Packs during stack updates or continuous compliance scans. The export includes issue details such as the violating resource, policy name, enforcement level, and severity.
      operationId: ExportPolicyIssues
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AngularGridGetRowsRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            text/plain:
              schema:
                type: string
          description: OK
        '400':
          description: Invalid request parameters
        '404':
          description: Organization not found
      summary: ExportPolicyIssues
      tags:
      - Organizations
  /api/orgs/{orgName}/policyresults/issues/filters:
    post:
      description: Returns the available filter options for listing policy issues, such as policy pack names, enforcement levels, severity values, and resource types. This is used to populate filter dropdowns in the policy issues UI.
      operationId: GetPolicyIssuesFilters
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PolicyIssueFiltersRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyIssueFiltersResponse'
          description: OK
        '400':
          description: Field parameter is required
        '404':
          description: Organization not found
      summary: GetPolicyIssuesFilters
      tags:
      - Organizations
  /api/orgs/{orgName}/policyresults/issues/{issueId}:
    get:
      description: Returns the details of a specific policy issue, including the violating resource, the policy pack and policy name that flagged the violation, the enforcement level (advisory or mandatory), severity, and the current triage status of the issue.
      operationId: GetPolicyIssue
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The issue identifier
        in: path
        name: issueId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetPolicyIssueResponse'
          description: OK
        '404':
          description: Organization or Policy issue not found
      summary: GetPolicyIssue
      tags:
      - Organizations
    patch:
      description: 'Updates a policy issue''s triage status and other mutable fields. All body fields are optional — only provide the fields you want to update.


        - `status`: `open`, `in_progress`, `by_design`, `fixed`, or `ignored`

        - `priority`: `p0`, `p1`, `p2`, `p3`, or `p4`

        - `assignedTo`: username to assign the issue to, or `null` to unassign'
      operationId: UpdatePolicyIssue
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The issue identifier
        in: path
        name: issueId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdatePolicyIssueRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetPolicyIssueResponse'
          description: OK
        '400':
          description: Invalid input
        '404':
          description: Organization or Policy issue not found
      summary: UpdatePolicyIssue
      tags:
      - Organizations
  /api/orgs/{orgName}/policyresults/metadata:
    get:
      description: Returns high-level policy compliance statistics for an organization, including total violation counts, breakdown by severity and enforcement level, and trends over time. This provides an overview of the organization's policy compliance posture.
      operationId: GetPolicyResultsMetadata
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyResultsMetadata'
          description: OK
        '404':
          description: Organization not found
      summary: GetPolicyResultsMetadata
      tags:
      - Organizations
  /api/orgs/{orgName}/policyresults/policies:
    post:
      description: Returns policy compliance data grouped by policy pack and policy name, showing how many stacks are in compliance or violation for each individual policy rule. Supports pagination and filtering via the grid request format.
      operationId: ListPoliciesCompliance
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AngularGridGetRowsRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPoliciesComplianceResponse'
          description: OK
        '400':
          description: Invalid grid request parameters
        '404':
          description: Organization not found
      summary: ListPoliciesCompliance
      tags:
      - Organizations
  /api/orgs/{orgName}/policyresults/violationsv2:
    get:
      deprecated: true
      description: 'ListPolicyViolationsV2Handler gets all the policy violations for an org.

        Deprecated: Use /policyresults/issues'
      operationId: ListPolicyViolationsV2
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListPolicyViolationsV2Response'
          description: OK
        '404':
          description: Organization not found
      summary: ListPolicyViolationsV2
      tags:
      - Organizations
      x-pulumi-route-property:
        Deprecated: true
        SupersededBy: ListPolicyIssues
        Visibility: Public
  /api/orgs/{orgName}/registry/policypacks/{policyPackName}:
    get:
      description: Retrieves lightweight registry metadata for a policy pack (source/publisher/name) without loading detailed policy definitions.
      operationId: GetOrgRegistryPolicyPack
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The policy pack name
        in: path
        name: policyPackName
        required: true
        schema:
          type: string
      - description: Version tag to retrieve (e.g., 'latest')
        in: query
        name: tag
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetRegistryPolicyPackVersionResponse'
          description: OK
        '404':
          description: Organization or Policy pack not found
      summary: GetOrgRegistryPolicyPack
      tags:
      - Organizations
  /api/orgs/{orgName}/resources/summary:
    get:
      description: 'GetUsageSummaryResourceHours handles request to fetch the summary

        of resources under management (RUM) and resource hours under management

        (RHUM) for an organization.'
      operationId: GetUsageSummaryResourceHours
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Time granularity for aggregation (e.g., 'hourly', 'daily', 'monthly')
        in: query
        name: granularity
        schema:
          type: string
      - description: Number of days to look back from the current time or lookbackStart
        in: query
        name: lookbackDays
        schema:
          format: int64
          type: integer
      - description: Unix timestamp for the start of the lookback period (defaults to current time if omitted)
        in: query
        name: lookbackStart
        schema:
          format: int64
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetResourceCountSummaryResponse'
          description: OK
        '204':
          description: No Content
      summary: GetUsageSummaryResourceHours
      tags:
      - Organizations
  /api/orgs/{orgName}/restore-stack:
    get:
      description: 'ListDeletedStacks returns the last 25 deleted stacks for a given org. It would be incredible to one day

        merge this function with `ListOrganizationProjects` -- but that function is very bloated and not performant, so implementing

        a lighter-weight handler focusing only on the most recently deleted stacks.'
      operationId: ListDeletedStacks
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListDeletedStacksResponse'
          description: OK
      summary: ListDeletedStacks
      tags:
      - Organizations
  /api/orgs/{orgName}/restore-stack/{programID}:
    post:
      description: 'RestoreDeletedStack un-deletes a soft-deleted stack for the given programID

        if the organization has the restore stacks feature enabled.'
      operationId: RestoreDeletedStack
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The program identifier
        in: path
        name: programID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestoreDeletedStackRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '404':
          description: program
        '409':
          description: Stack with this name already exists
      summary: RestoreDeletedStack
      tags:
      - Organizations
  /api/orgs/{orgName}/roles:
    get:
      description: Returns custom roles for an organization filtered by their UX purpose (e.g., 'organization', 'team', or 'token'). This allows the UI to display only the roles relevant to the current context, such as showing only organization-level roles when managing member access.
      operationId: ListRolesByOrgIDAndUXPurpose
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Filter roles by their UX purpose (e.g., 'organization', 'team', 'token')
        in: query
        name: uxPurpose
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRolesResponse'
          description: OK
        '400':
          description: Role purpose is not valid
      summary: ListRolesByOrgIDAndUXPurpose
      tags:
      - Organizations
    post:
      description: Creates a new custom role for an organization. Custom roles define fine-grained permission sets that can be assigned to organization members and teams, enabling precise access control beyond the built-in admin and member roles. Optionally, an associated policy and role binding can be created alongside the role.
      operationId: CreateRole
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Also create an associated policy and role binding alongside the role
        in: query
        name: createPolicyAndRole
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermissionDescriptorBase'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionDescriptorRecord'
          description: OK
        '400':
          description: 'Invalid role references: referenced role or permission set ID does not exist or is empty'
        '409':
          description: Role with this name already exists
      summary: CreateRole
      tags:
      - Organizations
  /api/orgs/{orgName}/roles/scopes:
    get:
      description: Returns all available permission scopes that can be assigned to custom roles, organized by category (e.g., stacks, teams, organization settings). Each scope represents a specific action or capability that can be granted or denied.
      operationId: ListAvailableScopes
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties:
                  items:
                    $ref: '#/components/schemas/RbacScopeGroup'
                  type: array
                type: object
          description: successful operation
      summary: ListAvailableScopes
      tags:
      - Organizations
  /api/orgs/{orgName}/roles/{roleID}:
    delete:
      description: Deletes a custom role from an organization. If the role is currently assigned to members or teams, deletion requires the force parameter. Deleting a role revokes the permissions it granted to any assigned members or teams.
      operationId: DeleteRole
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The role identifier
        in: path
        name: roleID
        required: true
        schema:
          type: string
      - description: Force deletion even if the role is currently assigned to members or teams
        in: query
        name: force
        schema:
          type: boolean
      responses:
        '204':
          description: No Content
        '400':
          description: invalid query parameter
        '404':
          description: Role
      summary: DeleteRole
      tags:
      - Organizations
    get:
      description: Returns the details of a specific custom role, including its name, description, and the set of permission scopes it grants. Custom roles enable fine-grained access control beyond the built-in admin and member roles.
      operationId: GetRole
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The role identifier
        in: path
        name: roleID
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionDescriptorRecord'
          description: OK
      summary: GetRole
      tags:
      - Organizations
    patch:
      description: Updates an existing custom role's name, description, or permission scopes. Changes take effect immediately for all members and teams assigned to the role.
      operationId: UpdateRole
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The role identifier
        in: path
        name: roleID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRoleRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionDescriptorRecord'
          description: OK
        '400':
          description: 'Invalid role references: referenced role or permission set ID does not exist or is empty'
        '409':
          description: Role with this name already exists
      summary: UpdateRole
      tags:
      - Organizations
  /api/orgs/{orgName}/roles/{roleID}/default:
    patch:
      description: Sets the default custom role for the organization. New members who join the organization will be automatically assigned this role unless a different role is specified during the invitation process.
      operationId: UpdateOrganizationDefaultRole
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The role identifier
        in: path
        name: roleID
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: Invalid role type
      summary: UpdateOrganizationDefaultRole
      tags:
      - Organizations
  /api/orgs/{orgName}/roles/{roleID}/teams:
    get:
      operationId: ListTeamsWithRole
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The role identifier
        in: path
        name: roleID
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListTeamsWithRoleResponse'
          description: OK
      summary: ListTeamsWithRole
      tags:
      - Organizations
  /api/orgs/{orgName}/roles/{roleID}/tokens:
    get:
      description: Returns all organization tokens that have been assigned to a specific custom role. This helps administrators audit which tokens have particular permission levels and manage token-to-role assignments for least-privilege access.
      operationId: ListOrgTokensWithRole
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The role identifier
        in: path
        name: roleID
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListAccessTokensResponse'
          description: OK
      summary: ListOrgTokensWithRole
      tags:
      - Organizations
  /api/orgs/{orgName}/roles/{roleID}/users:
    get:
      operationId: ListUsersWithRole
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The role identifier
        in: path
        name: roleID
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListUsersWithRoleResponse'
          description: OK
      summary: ListUsersWithRole
      tags:
      - Organizations
  /api/orgs/{orgName}/saml:
    get:
      description: Returns the SAML configuration data for an organization, including the SSO endpoint URL, identity provider metadata, and SAML attribute mappings. SAML-backed organizations use an external identity provider for user authentication and can enforce single sign-on for all members.
      operationId: GetSAMLOrganization
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SAMLOrganization'
          description: OK
      summary: GetSAMLOrganization
      tags:
      - Organizations
    patch:
      description: Updates the SAML configuration for a SAML-backed organization, including the identity provider SSO descriptor, attribute mappings, and other SAML settings. The new IDP SSO descriptor is required in the update request.
      operationId: UpdateSAMLOrganization
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateSAMLOrganizationRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SAMLOrganization'
          description: OK
        '400':
          description: NewIDPSSODescriptor is required.
        '404':
          description: SAML Organization
      summary: UpdateSAMLOrganization
      tags:
      - Organizations
  /api/orgs/{orgName}/saml/admins:
    get:
      description: 'ListSAMLOrganizationAdmins returns the list of SAML admins for an organization.

        We currently only support one SAML admin per organization, where the SAML admin is

        the user who onboarded the organization to SAML.'
      operationId: ListSAMLOrganizationAdmins
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListSAMLOrganizationAdminsResponse'
          description: OK
      summary: ListSAMLOrganizationAdmins
      tags:
      - Organizations
  /api/orgs/{orgName}/saml/admins/{userLogin}:
    post:
      description: Updates the SAML admin for an organization. The SAML admin is the user who manages the SAML SSO configuration. Currently, each organization supports only one SAML admin (typically the user who onboarded the organization to SAML). The new admin must not belong to other organizations.
      operationId: UpdateSAMLOrganizationAdmins
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The user login name
        in: path
        name: userLogin
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: Requesting user belongs to other organizations
      summary: UpdateSAMLOrganizationAdmins
      tags:
      - Organizations
  /api/orgs/{orgName}/search:
    head:
      description: Returns a 200 response if the search cluster is available and healthy, 404 otherwise. This is a lightweight health check used to determine whether resource search functionality is operational for the organization.
      operationId: SearchClusterAvailable
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                type: boolean
          description: OK
        '404':
          description: search cluster
      summary: SearchClusterAvailable
      tags:
      - Organizations
  /api/orgs/{orgName}/search/column-set:
    get:
      description: Returns aggregation results for a given field in resource search, providing the unique values and counts for a specific field like 'type', 'package', or 'project'. This is used to populate filter dropdowns and faceted navigation in the resource search UI.
      operationId: GetResourceColumnFilterSet
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The resource field to aggregate (e.g., 'type', 'package', 'project')
        in: query
        name: field
        schema:
          type: string
      - description: Search query string
        in: query
        name: query
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties:
                  $ref: '#/components/schemas/Aggregation'
                type: object
          description: successful operation
        '400':
          description: missing field parameter
        '422':
          description: search cluster is unreachable
      summary: GetResourceColumnFilterSet
      tags:
      - Organizations
  /api/orgs/{orgName}/search/resources:
    get:
      deprecated: true
      description: 'Searches for resources within an organization. Deprecated: use GetOrgResourceSearchV2Query for improved search functionality.'
      operationId: GetOrgResourceSearchQuery
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Collapse results to show one entry per stack instead of per resource
        in: query
        name: collapse
        schema:
          type: boolean
      - description: Cursor for paginated results
        in: query
        name: cursor
        schema:
          type: string
      - description: Facet filters to apply
        in: query
        name: facet
        schema:
          items:
            type: string
          type: array
      - description: Group results by this field
        in: query
        name: groupBy
        schema:
          type: string
      - description: Page number for pagination
        in: query
        name: page
        schema:
          format: int64
          type: integer
      - description: Include resource properties in search results (may increase response size)
        in: query
        name: properties
        schema:
          type: boolean
      - description: Search query string
        in: query
        name: query
        schema:
          type: string
      - description: Number of results to return
        in: query
        name: size
        schema:
          format: int64
          type: integer
      - description: Sort order for results
        in: query
        name: sort
        schema:
          items:
            type: string
          type: array
      - description: Number of top aggregation buckets to return
        in: query
        name: top
        schema:
          format: int64
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceSearchResult'
          description: OK
        '400':
          description: invalid groupBy field
        '422':
          description: search cluster is unreachable
      summary: GetOrgResourceSearchQuery
      tags:
      - Organizations
      x-pulumi-route-property:
        Deprecated: true
        SupersededBy: GetOrgResourceSearchV2Query
        Visibility: Public
  /api/orgs/{orgName}/search/resources/dashboard:
    get:
      description: GetResourceDashboardAggregations returns aggregated resource data for display on organization dashboard cards, including resource counts grouped by package and other dimensions.
      operationId: GetResourceDashboardAggregations
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceSearchResult'
          description: OK
        '404':
          description: Organization not found
        '422':
          description: search cluster is unreachable
      summary: GetResourceDashboardAggregations
      tags:
      - Organizations
  /api/orgs/{orgName}/search/resources/export:
    get:
      description: ExportOrgResourceSearchQuery exports resource search results as a CSV file download. Supports the same query parameters as the standard resource search to filter results.
      operationId: ExportOrgResourceSearchQuery
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Collapse results to show one entry per stack instead of per resource
        in: query
        name: collapse
        schema:
          type: boolean
      - description: Cursor for paginated results
        in: query
        name: cursor
        schema:
          type: string
      - description: Facet filters to apply
        in: query
        name: facet
        schema:
          items:
            type: string
          type: array
      - description: Page number for pagination
        in: query
        name: page
        schema:
          format: int64
          type: integer
      - description: Include resource properties in search results (may increase response size)
        in: query
        name: properties
        schema:
          type: boolean
      - description: Search query string
        in: query
        name: query
        schema:
          type: string
      - description: Number of results to return
        in: query
        name: size
        schema:
          format: int64
          type: integer
      - description: Sort order for results
        in: query
        name: sort
        schema:
          items:
            type: string
          type: array
      - description: Number of top aggregation buckets to return
        in: query
        name: top
        schema:
          format: int64
          type: integer
      responses:
        '200':
          content:
            text/plain:
              schema:
                type: string
          description: CSV file with exported resource data
        '422':
          description: search cluster is unreachable
      summary: ExportOrgResourceSearchQuery
      tags:
      - Organizations
  /api/orgs/{orgName}/search/resources/parse:
    get:
      description: GetNaturalLanguageQuery converts a natural language query into a structured Pulumi search query using AI. For example, converts 'show me all S3 buckets in production' into a proper search syntax.
      operationId: GetNaturalLanguageQuery
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Search query string
        in: query
        name: query
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetNaturalLanguageQueryResponse'
          description: OK
        '400':
          description: please provide a query
        '402':
          description: AI assist feature requires Enterprise subscription
        '404':
          description: NLP search feature not enabled
        '503':
          description: AI services are temporarily unavailable
      summary: GetNaturalLanguageQuery
      tags:
      - Organizations
  /api/orgs/{orgName}/search/resourcesv2:
    get:
      description: 'Searches for resources within an organization with advanced filtering, sorting, and pagination capabilities.


        **Pagination:** The `page` parameter supports up to 10,000 results. For larger result sets, use the `cursor` parameter instead (Enterprise plans only). Note that pagination is not transactional — result ordering may change if a stack update completes during pagination.


        **Sorting:** The `sort` parameter accepts: `created`, `custom`, `delete`, `dependencies`, `id`, `modified`, `module`, `name`, `package`, `parentUrn`, `project`, `protected`, `providerUrn`, `stack`, `type`, `urn`, `managed`, `category`. If omitted, results are sorted by search relevance (or last modified time when no query is provided).


        **Properties:** Set `properties=true` to include resource input/output values. Requires a supported subscription — returns 402 if not available.


        **Collapse:** Set `collapse=true` to consolidate resources that exist in multiple sources (e.g., both IaC stacks and Insights scans) into a single result.'
      operationId: GetOrgResourceSearchV2Query
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Sort in ascending order when true, descending when false
        in: query
        name: asc
        schema:
          type: boolean
      - description: Collapse results to show one entry per stack instead of per resource
        in: query
        name: collapse
        schema:
          type: boolean
      - description: Cursor for paginated results
        in: query
        name: cursor
        schema:
          type: string
      - description: Facet filters to apply
        in: query
        name: facet
        schema:
          items:
            type: string
          type: array
      - description: Group results by this field
        in: query
        name: groupBy
        schema:
          type: string
      - description: Page number for pagination
        in: query
        name: page
        schema:
          format: int64
          type: integer
      - description: Include resource properties in search results (may increase response size)
        in: query
        name: properties
        schema:
          type: boolean
      - description: Search query string
        in: query
        name: query
        schema:
          type: string
      - description: Number of results to return
        in: query
        name: size
        schema:
          format: int64
          type: integer
      - description: Sort order for results
        in: query
        name: sort
        schema:
          items:
            type: string
          type: array
      - description: Number of top aggregation buckets to return
        in: query
        name: top
        schema:
          format: int64
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceSearchResult'
          description: OK
        '400':
          description: invalid groupBy field
        '422':
          description: search cluster is unreachable
      summary: GetOrgResourceSearchV2Query
      tags:
      - Organizations
  /api/orgs/{orgName}/secrets/summary:
    get:
      description: 'GetUsageSummaryEnvironmentSecrets handles request to fetch the summary

        of ESC secret hours for an organization.'
      operationId: GetUsageSummaryEnvironmentSecrets
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Time granularity for aggregation (e.g., 'hourly', 'daily', 'monthly')
        in: query
        name: granularity
        schema:
          type: string
      - description: Number of days to look back from the current time or lookbackStart
        in: query
        name: lookbackDays
        schema:
          format: int64
          type: integer
      - description: Unix timestamp for the start of the lookback period (defaults to current time if omitted)
        in: query
        name: lookbackStart
        schema:
          format: int64
          type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetResourceCountSummaryResponse'
          description: OK
        '204':
          description: No Content
      summary: GetUsageSummaryEnvironmentSecrets
      tags:
      - Organizations
  /api/orgs/{orgName}/services:
    get:
      description: Returns all service accounts in an organization. Service accounts provide programmatic, non-human identities for accessing Pulumi Cloud resources. They can hold access tokens, belong to teams, and have stack permissions, making them suitable for CI/CD pipelines, automation tools, and other machine-to-machine integrations.
      operationId: ListServices
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListServicesResponse'
          description: OK
      summary: ListServices
      tags:
      - Organizations
    post:
      description: Creates a new service account in an organization. Service accounts provide programmatic, non-human identities for accessing Pulumi Cloud resources. They are scoped to an organization and can hold access tokens, belong to teams, and have stack permissions. The service name must be unique within the organization.
      operationId: CreateService
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateServiceRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Service'
          description: OK
        '400':
          description: Invalid service data provided
        '404':
          description: service
        '409':
          description: Service with this name already exists
      summary: CreateService
      tags:
      - Organizations
  /api/orgs/{orgName}/services/{ownerType}/{ownerName}/{serviceName}:
    delete:
      description: Deletes a service account from an organization. Service accounts provide programmatic, non-human access to Pulumi Cloud resources. If the service has other members, deletion requires explicit confirmation via the force parameter. All access tokens and permissions associated with the service are revoked.
      operationId: DeleteService
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The owner type
        in: path
        name: ownerType
        required: true
        schema:
          type: string
      - description: The owner name
        in: path
        name: ownerName
        required: true
        schema:
          type: string
      - description: The service name
        in: path
        name: serviceName
        required: true
        schema:
          type: string
      - description: Force deletion even if the service has other members
        in: query
        name: force
        schema:
          type: boolean
      responses:
        '204':
          description: No Content
        '400':
          description: invalid query parameter
        '404':
          description: service
        '412':
          description: confirmation is required to delete service with other members
      summary: DeleteService
      tags:
      - Organizations
    get:
      description: Returns the details of a specific service account, including its name, owner, description, team memberships, access tokens, and stack permissions. Service accounts provide programmatic, non-human access to Pulumi Cloud resources and are identified by their owner type, owner name, and service name.
      operationId: GetService
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The owner type
        in: path
        name: ownerType
        required: true
        schema:
          type: string
      - description: The owner name
        in: path
        name: ownerName
        required: true
        schema:
          type: string
      - description: The service name
        in: path
        name: serviceName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetServiceResponse'
          description: OK
      summary: GetService
      tags:
      - Organizations
    head:
      description: Checks whether a service account exists in the organization without returning its full details. Returns 204 No Content if the service exists, or an error if not found. This is a lightweight check useful for validating service account references.
      operationId: HeadService
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The owner type
        in: path
        name: ownerType
        required: true
        schema:
          type: string
      - description: The owner name
        in: path
        name: ownerName
        required: true
        schema:
          type: string
      - description: The service name
        in: path
        name: serviceName
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
      summary: HeadService
      tags:
      - Organizations
    patch:
      description: Updates the metadata and configuration of an existing service account, such as its description, team memberships, and access settings. Service accounts provide programmatic, non-human access to Pulumi Cloud resources.
      operationId: UpdateService
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The owner type
        in: path
        name: ownerType
        required: true
        schema:
          type: string
      - description: The owner name
        in: path
        name: ownerName
        required: true
        schema:
          type: string
      - description: The service name
        in: path
        name: serviceName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateServiceMetadataRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Service'
          description: OK
        '400':
          description: Invalid service update data provided or invalid member type.
        '404':
          description: service
      summary: UpdateService
      tags:
      - Organizations
  /api/orgs/{orgName}/services/{ownerType}/{ownerName}/{serviceName}/items:
    post:
      description: Adds items (such as access tokens, team memberships, or stack permissions) to an existing service account. Service accounts provide programmatic, non-human access to Pulumi Cloud resources and are scoped to an organization. Items define what the service account can access and what credentials it holds. Returns the updated service details.
      operationId: AddServiceItems
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The owner type
        in: path
        name: ownerType
        required: true
        schema:
          type: string
      - description: The owner name
        in: path
        name: ownerName
        required: true
        schema:
          type: string
      - description: The service name
        in: path
        name: serviceName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AddServiceItemsRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetServiceResponse'
          description: OK
        '400':
          description: Invalid service item data provided.
      summary: AddServiceItems
      tags:
      - Organizations
  /api/orgs/{orgName}/services/{ownerType}/{ownerName}/{serviceName}/items/{itemType}/{itemName}:
    delete:
      description: Removes a specific item (such as a team membership, access token, or stack permission) from a service account. Returns the updated service details after the item has been removed.
      operationId: RemoveServiceItem
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The owner type
        in: path
        name: ownerType
        required: true
        schema:
          type: string
      - description: The owner name
        in: path
        name: ownerName
        required: true
        schema:
          type: string
      - description: The service name
        in: path
        name: serviceName
        required: true
        schema:
          type: string
      - description: The item type
        in: path
        name: itemType
        required: true
        schema:
          type: string
      - description: The item name
        in: path
        name: itemName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetServiceResponse'
          description: OK
        '400':
          description: invalid item name
      summary: RemoveServiceItem
      tags:
      - Organizations
  /api/orgs/{orgName}/teams:
    get:
      description: Retrieves all teams within an organization. Teams provide a centralized way to manage stack access permissions for groups of users. The response includes each team's name, type (Pulumi-managed, GitHub-backed, or GitLab-backed), member count, and summary of stack permissions. Teams are available to organizations on Enterprise and Business Critical editions.
      operationId: ListTeams
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListTeamsResponse'
          description: OK
      summary: ListTeams
      tags:
      - Organizations
  /api/orgs/{orgName}/teams/github:
    post:
      description: Creates a new Pulumi team backed by a GitHub team. When an organization is backed by GitHub, existing GitHub teams can be imported into Pulumi to manage stack permissions. Membership is managed through GitHub while stack access permissions are controlled within Pulumi Cloud. The request must include the GitHub team ID. Returns 409 if a team with the same name already exists.
      operationId: CreateGitHubTeam
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateGitHubTeamRequest'
        x-originalParamName: body
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Team'
          description: Created
        '400':
          description: No TeamID provided.
        '404':
          description: GitHub Team
        '409':
          description: Team with this name already exists
      summary: CreateGitHubTeam
      tags:
      - Organizations
  /api/orgs/{orgName}/teams/pulumi:
    post:
      description: 'CreatePulumiTeam creates a "Pulumi" team, i.e. one whose membership is managed by Pulumi.

        (As opposed to a GitHub or GitLab-based team.)'
      operationId: CreatePulumiTeam
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreatePulumiTeamRequest'
        x-originalParamName: body
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Team'
          description: Created
        '400':
          description: Display name too long. Max length 100 characters.
        '409':
          description: Team with this name already exists
      summary: CreatePulumiTeam
      tags:
      - Organizations
  /api/orgs/{orgName}/teams/{teamName}:
    delete:
      description: Permanently removes a team from an organization. All stack permission grants assigned to the team are revoked, and team members lose any access that was granted solely through team membership. Team tokens associated with the team are also invalidated. This action cannot be undone.
      operationId: DeleteTeam
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The team name
        in: path
        name: teamName
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '404':
          description: Team
      summary: DeleteTeam
      tags:
      - Organizations
    get:
      description: Retrieves detailed information about a specific team within an organization. The response includes the team name, display name, description, team type (Pulumi-managed, GitHub-backed, or GitLab-backed), list of members with their roles (team admin or team member), and the stack permissions granted to the team. Teams provide a centralized way to manage stack access for groups of users.
      operationId: GetTeam
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The team name
        in: path
        name: teamName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Team'
          description: OK
      summary: GetTeam
      tags:
      - Organizations
    patch:
      description: 'Updates a team''s membership and configuration. This multi-purpose endpoint supports several operations:


        **Update membership:** Use `member` (username) and `memberAction` (`add` or `remove`) to manage team members.


        **Grant stack access:** Use `addStackPermission` with `projectName`, `stackName`, and `permission` (integer: `101` = read, `102` = edit, `103` = admin).


        **Remove stack access:** Use `removeStack` with `projectName` and `stackName`.


        Members added to a team inherit the team''s stack permissions. Teams are not available to individual (single-user) organizations.'
      operationId: UpdateTeam
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The team name
        in: path
        name: teamName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTeamRequest'
        x-originalParamName: body
      responses:
        '204':
          description: No Content
        '400':
          description: Teams are not available to individual orgs.
      summary: UpdateTeam
      tags:
      - Organizations
  /api/orgs/{orgName}/teams/{teamName}/enable-team-roles:
    post:
      description: Enables custom role-based access control for a team. Once enabled, the team can be assigned custom roles that define fine-grained permissions beyond the default team admin and team member roles. Returns the created role descriptor.
      operationId: EnableTeamRoles
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The team name
        in: path
        name: teamName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionDescriptorRecord'
          description: OK
        '400':
          description: Role with this name already exists
      summary: EnableTeamRoles
      tags:
      - Organizations
  /api/orgs/{orgName}/teams/{teamName}/roles:
    get:
      description: 'ListTeamRoles will list the roles for a team. For now, this will always be a

        list of one, since we currently only support one role per team.'
      operationId: ListTeamRoles
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The team name
        in: path
        name: teamName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListTeamRolesResponse'
          description: OK
        '404':
          description: Role
      summary: ListTeamRoles
      tags:
      - Organizations
  /api/orgs/{orgName}/teams/{teamName}/roles/{roleID}:
    delete:
      description: Removes a custom role assignment from a team. This revokes the permissions that were granted to team members through the role. Currently only one role can be assigned per team.
      operationId: DeleteTeamRole
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The team name
        in: path
        name: teamName
        required: true
        schema:
          type: string
      - description: The role identifier
        in: path
        name: roleID
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '404':
          description: Role
      summary: DeleteTeamRole
      tags:
      - Organizations
    post:
      description: 'UpdateTeamRoles upserts the role assigned to a team since we currently only support

        a 1:1 mapping of teams to roles.'
      operationId: UpdateTeamRoles
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The team name
        in: path
        name: teamName
        required: true
        schema:
          type: string
      - description: The role identifier
        in: path
        name: roleID
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: Role with this name already exists
      summary: UpdateTeamRoles
      tags:
      - Organizations
  /api/orgs/{orgName}/teams/{teamName}/tokens:
    get:
      description: Retrieves all access tokens for a specific team. Team tokens inherit the stack permissions assigned to the team, providing scoped CI/CD automation access. The response includes token metadata such as name, description, creation date, last used date, and expiration status. The actual token values are never returned after initial creation. An optional filter parameter can include expired tokens.
      operationId: ListTeamTokens
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The team name
        in: path
        name: teamName
        required: true
        schema:
          type: string
      - description: Filter tokens by status (e.g., include expired tokens)
        in: query
        name: filter
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListAccessTokensResponse'
          description: OK
      summary: ListTeamTokens
      tags:
      - Organizations
    post:
      description: 'Generates a new access token scoped to a specific team within an organization. Team tokens inherit the stack permissions assigned to the team, making them suitable for CI/CD pipelines that need access limited to a specific set of stacks.


        The `name` field must be unique across the organization (including deleted tokens) and cannot exceed 40 characters. The `expires` field accepts a unix epoch timestamp up to two years from the present, or `0` for no expiry (default).


        **Important:** The token value in the response is only returned once at creation time and cannot be retrieved later.'
      operationId: CreateTeamToken
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The team name
        in: path
        name: teamName
        required: true
        schema:
          type: string
      - description: Audit log reason for creating this token
        in: query
        name: reason
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTeamAccessTokenRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateAccessTokenResponse'
          description: OK
      summary: CreateTeamToken
      tags:
      - Organizations
  /api/orgs/{orgName}/teams/{teamName}/tokens/{tokenId}:
    delete:
      description: Permanently revokes and deletes a team access token. Any CI/CD pipelines or automation using this token will immediately lose access to the stacks assigned to the team. This action cannot be undone.
      operationId: DeleteTeamToken
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The team name
        in: path
        name: teamName
        required: true
        schema:
          type: string
      - description: The access token identifier
        in: path
        name: tokenId
        required: true
        schema:
          type: string
      - description: Audit log reason for deleting this token
        in: query
        name: reason
        schema:
          type: string
      responses:
        '204':
          description: No Content
        '400':
          description: the requested token is not a team token
      summary: DeleteTeamToken
      tags:
      - Organizations
  /api/orgs/{orgName}/template:
    get:
      description: 'GetProjectTemplate attempts to fetch Pulumi.yaml from a template

        repository. If the repository represents a valid template, we return a

        response identical to the format we use for the public pulumi/templates

        repo.


        This API accepts either a `url` or `project` query param to denote

        either where to fetch the project template from or which project''s

        pre-configured template to use respectively. If both are passed in `project`

        take precedence, falling back to `url` if there is no source configured on

        the project.'
      operationId: GetProjectTemplate
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
          description: OK
        '400':
          description: 'missing required query param: oneof [url, project]'
        '404':
          description: project
        '422':
          description: invalid template
      summary: GetProjectTemplate
      tags:
      - Organizations
  /api/orgs/{orgName}/template/configuration:
    get:
      description: 'GetProjectTemplateConfiguration attempts to lookup any config we store

        for the template using the template query parameter passed in as a key

        into the org''s template sources.'
      operationId: GetProjectTemplateConfiguration
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTemplateConfigurationResponse'
          description: OK
        '400':
          description: 'missing required query param: url'
      summary: GetProjectTemplateConfiguration
      tags:
      - Organizations
  /api/orgs/{orgName}/template/download:
    get:
      description: Downloads a template archive for an organization as an application/x-tar binary stream. The template is identified by a URL query parameter pointing to the template source. Returns the tar archive containing the template's project files and configuration.
      operationId: GetOrgTemplateDownload
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/x-tar:
              schema:
                items:
                  format: byte
                  type: string
                type: array
          description: OK
        '400':
          description: 'missing required query param: url'
      summary: GetOrgTemplateDownload
      tags:
      - Organizations
  /api/orgs/{orgName}/template/readme:
    get:
      description: Returns the README content for an organization template as Markdown text. The template is identified by a URL query parameter. Returns 404 if the template does not contain a README.md file, or 422 if the README content is invalid.
      operationId: GetOrgTemplateReadme
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            text/markdown:
              schema:
                type: string
          description: OK
        '400':
          description: 'missing required query param: url'
        '404':
          description: README.md
        '422':
          description: invalid readme
      summary: GetOrgTemplateReadme
      tags:
      - Organizations
  /api/orgs/{orgName}/templates:
    get:
      description: Returns a combined list of all templates available to the organization and the current user. This includes templates from the organization's configured template collections as well as Pulumi's built-in public templates. Each template includes its name, description, language, and source URL.
      operationId: GetOrgTemplates
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOrgTemplatesResponse'
          description: OK
      summary: GetOrgTemplates
      tags:
      - Organizations
  /api/orgs/{orgName}/templates/sources:
    get:
      description: Returns all template collections (sources) configured for an organization. Template collections define where project templates are sourced from, such as Git repositories. Each collection includes its name, URL, and the templates it provides.
      operationId: GetOrgTemplateCollections
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOrgTemplateSourcesResponse'
          description: OK
      summary: GetOrgTemplateCollections
      tags:
      - Organizations
    post:
      description: Creates a new template collection (source) for an organization. Template collections define where project templates are sourced from, such as a Git repository. Organization members can use these templates to create new stacks with pre-configured infrastructure code.
      operationId: CreateOrgTemplateCollection
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpsertOrgTemplateSourceRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TemplateSource'
          description: OK
        '400':
          description: unsupported template source
        '404':
          description: template source
        '409':
          description: a template source with this name already exists in this organization
      summary: CreateOrgTemplateCollection
      tags:
      - Organizations
  /api/orgs/{orgName}/templates/sources/{templateID}:
    delete:
      description: Removes a template collection (source) from an organization. Templates sourced from this collection will no longer be available to organization members when creating new stacks. Returns 400 if the template ID is invalid, or 404 if the template source does not exist.
      operationId: DeleteOrgTemplateCollection
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The template identifier
        in: path
        name: templateID
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
        '400':
          description: invalid template ID
        '404':
          description: Template source
      summary: DeleteOrgTemplateCollection
      tags:
      - Organizations
    patch:
      description: Updates an existing template collection for an organization, allowing modification of the template source URL, name, or other configuration. Template collections define where project templates are sourced from.
      operationId: UpdateOrgTemplateCollection
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The template identifier
        in: path
        name: templateID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpsertOrgTemplateSourceRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TemplateSource'
          description: OK
        '400':
          description: invalid template ID
        '404':
          description: Template Source
        '409':
          description: a template source with this name already exists in this organization
      summary: UpdateOrgTemplateCollection
      tags:
      - Organizations
  /api/orgs/{orgName}/tokens:
    get:
      description: Retrieves all access tokens created for an organization. Organization tokens provide CI/CD automation access scoped to the organization rather than tied to individual user accounts. The response includes token metadata such as name, description, creation date, last used date, and expiration status. The actual token values are never returned after initial creation. An optional filter parameter can include expired tokens in the results.
      operationId: ListOrgTokens
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Filter tokens by status (e.g., include expired tokens)
        in: query
        name: filter
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListAccessTokensResponse'
          description: OK
      summary: ListOrgTokens
      tags:
      - Organizations
    post:
      description: 'Generates a new access token scoped to the organization for use in CI/CD pipelines and automated workflows. Organization tokens belong to the organization rather than individual users, ensuring that access is not disrupted when team members leave.


        The `name` field must be unique across the organization (including deleted tokens) and cannot exceed 40 characters. The `expires` field accepts a unix epoch timestamp up to two years from the present, or `0` for no expiry (default).


        **Important:** The token value in the response is only returned once at creation time and cannot be retrieved later. Audit logs for actions performed with organization tokens are attributed to the organization rather than an individual user.'
      operationId: CreateOrgToken
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: Audit log reason for creating this token
        in: query
        name: reason
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOrgAccessTokenRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateAccessTokenResponse'
          description: OK
      summary: CreateOrgToken
      tags:
      - Organizations
  /api/orgs/{orgName}/tokens/{tokenId}:
    delete:
      description: Permanently revokes and deletes an organization access token. Any CI/CD pipelines or automation using this token will immediately lose access to the organization's resources. This action cannot be undone.
      operationId: DeleteOrgToken
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The access token identifier
        in: path
        name: tokenId
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
      summary: DeleteOrgToken
      tags:
      - Organizations
  /api/projects/{orgName}/{projectName}/batch-decrypt:
    post:
      description: BatchDecryptProjectValue works just like BatchDecryptValueHandler, but using the project's encryption key instead of the stack's
      operationId: BatchDecryptProjectValue
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The project name
        in: path
        name: projectName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppBatchDecryptResponse'
          description: OK
        '404':
          description: project
      summary: BatchDecryptProjectValue
      tags:
      - Organizations
  /api/projects/{orgName}/{projectName}/decrypt:
    post:
      description: DecryptProjectValue works just like DecryptValueHandler, but using the project's encryption key instead of the stack's
      operationId: DecryptProjectValue
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The project name
        in: path
        name: projectName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppDecryptValueResponse'
          description: OK
        '404':
          description: project
      summary: DecryptProjectValue
      tags:
      - Organizations
  /api/projects/{orgName}/{projectName}/encrypt:
    post:
      description: 'EncryptProjectValue encrypts a value using the project''s key. The request body contains the base64

        encoded value to be encrypted.'
      operationId: EncryptProjectValue
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The project name
        in: path
        name: projectName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppEncryptValueResponse'
          description: OK
        '404':
          description: project
      summary: EncryptProjectValue
      tags:
      - Organizations
  /api/stacks/{orgName}/{projectName}:
    head:
      description: Checks whether a project exists within an organization. Returns 200 with the project name if it exists, or 404 if not found. This is a lightweight existence check useful for validating project names before creating stacks or performing other operations.
      operationId: ProjectExists
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The project name
        in: path
        name: projectName
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                type: string
          description: OK
        '404':
          description: Project
      summary: ProjectExists
      tags:
      - Organizations
    post:
      description: 'Creates a new stack within a project in the organization. If the project does not exist, it will be created. A stack is an isolated, independently configurable instance of a Pulumi program, typically representing a deployment environment (e.g., development, staging, production). The stack name must be unique within the project.


        The optional `config` object supports:

        - `environment`: reference to an ESC environment for storing stack configuration (must not already exist)

        - `secretsProvider`: the secrets provider for the stack

        - `encryptedKey`: KMS-encrypted ciphertext for the data key (cloud-based secrets providers only)

        - `encryptionSalt`: base64-encoded encryption salt (passphrase-based secrets providers only)'
      operationId: CreateStack
      parameters:
      - description: The organization name
        in: path
        name: orgName
        required: true
        schema:
          type: string
      - description: The project name
        in: path
        name: projectName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            example:
              stackName: production
              tags:
                environment: prod
                owner: platform
              teams:
              - platform
              - sre
            schema:
              $ref: '#/components/schemas/AppCreateStackRequest'
        x-originalParamName: body
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppCreateStackResponse'
          description: OK
      summary: CreateStack
      tags:
      - Organizations
components:
  schemas:
    ChangeGate:
      description: A change gate requires that certain actions on an entity are staged via a change request, and established conditions that change request must satisfy to be applied.
      properties:
        enabled:
          description: Whether the change gate is enabled
          type: boolean
          x-order: 3
        id:
          description: Unique identifier of the change gate
          type: string
          x-order: 1
        name:
          description: Name of the change gate
          type: string
          x-order: 2
        rule:
          $ref: '#/components/schemas/ChangeGateRuleOutput'
          description: Rule configuration for the gate
          x-order: 4
        target:
          $ref: '#/components/schemas/ChangeGateTargetOutput'
          description: Target configuration for the gate
          x-order: 5
      required:
      - enabled
      - id
      - name
      - rule
      - target
      type: object
    PolicyComplianceResult:
      description: Policy compliance result row for an entity
      properties:
        entityName:
          description: Entity name (stack name or account name)
          type: string
          x-order: 1
        scores:
          description: Array of compliance scores correlating to columns array. -1 indicates N/A
          items:
            format: int64
            type: integer
          type: array
          x-order: 2
      required:
      - entityName
      - scores
      type: object
    AppPolicyComplianceFramework:
      description: PolicyComplianceFramework represents a compliance framework that a policy belongs to.
      properties:
        name:
          description: The compliance framework name.
          type: string
          x-order: 1
        reference:
          description: The compliance framework reference.
          type: string
          x-order: 3
        specification:
          description: The compliance framework specification.
          type: string
          x-order: 4
        version:
          description: The compliance framework version.
          type: string
          x-order: 2
      type: object
    RemoveStackIdentifier:
      description: RemoveStackIdentifier is the identifier used in the UpdateTeamRequest when removing a stack from a team.
      properties:
        projectName:
          description: The name of the project containing the stack.
          type: string
          x-order: 1
        stackName:
          description: The name of the stack to remove.
          type: string
          x-order: 2
      required:
      - projectName
      - stackName
      type: object
    AppGetPolicyPackConfigSchemaResponse:
      description: 'GetPolicyPackConfigSchemaResponse is the response that includes the JSON

        schemas of Policies within a particular Policy Pack.'
      properties:
        configSchema:
          additionalProperties:
            $ref: '#/components/schemas/AppPolicyConfigSchema'
          description: The JSON schema for each Policy's configuration.
          type: object
          x-order: 1
      type: object
    PkixExtension:
      description: PkixExtension represents an X.509 certificate extension.
      properties:
        Critical:
          description: Whether this extension is critical.
          type: boolean
          x-order: 2
        Id:
          description: The ASN.1 object identifier of the extension.
          type: string
          x-order: 1
        Value:
          description: The raw extension value.
          items:
            format: byte
            type: string
          type: array
          x-order: 3
      required:
      - Critical
      - Id
      - Value
      type: object
    PolicyIssueFiltersResponse:
      description: PolicyIssueFiltersResponse contains the available filter values for a given field in policy issues.
      properties:
        field:
          description: The field name for which filter values are provided.
          type: string
          x-order: 1
        values:
          description: The available filter values for the field.
          items:
            $ref: '#/components/schemas/PolicyIssueFilterValue'
          type: array
          x-order: 2
      required:
      - field
      - values
      type: object
    ListTeamsWithRoleResponse:
      description: ListTeamsWithRoleResponse is the shape of the response when listing teams with a given role within an organization.
      properties:
        teams:
          description: Teams that are backed by the given role.
          items:
            $ref: '#/components/schemas/Team'
          type: array
          x-order: 1
      required:
      - teams
      type: object
    ListOrganizationMembersResponse:
      description: ListOrganizationMembersResponse lists all members within an organization.
      properties:
        continuationToken:
          description: An opaque token for fetching the next page of members
          type: string
          x-order: 2
        members:
          description: The list of organization members
          items:
            $ref: '#/components/schemas/OrganizationMember'
          type: array
          x-order: 1
      required:
      - members
      type: object
    ListTeamRolesResponse:
      description: ListTeamRolesResponse is the response when listing the fine-grained assigned to a team.
      properties:
        roles:
          description: The list of roles assigned to the team
          items:
            $ref: '#/components/schemas/PermissionDescriptorRecord'
          type: array
          x-order: 1
      required:
      - roles
      type: object
    UpsertOrgTemplateSourceRequest:
      description: Request to create or update an organization template source.
      properties:
        destination:
          $ref: '#/components/schemas/TemplateDestination'
          description: deprecated - use DestinationURL instead
          x-order: 4
        destinationURL:
          description: The destination URL for the template source.
          type: string
          x-order: 3
        name:
          description: The name of the template source.
          type: string
          x-order: 1
        sourceURL:
          description: The source URL to fetch templates from.
          type: string
          x-order: 2
      required:
      - name
      - sourceURL
      type: object
    WorkflowRun:
      description: WorkflowRun contains information about a workflow run.
      properties:
        finishedAt:
          description: The time the workflow run finished, if completed.
          format: date-time
          type: string
          x-order: 6
        id:
          description: The unique identifier of the workflow run.
          type: string
          x-order: 1
        jobTimeout:
          description: The timeout for jobs in the workflow run.
          format: date-time
          type: string
          x-order: 8
        jobs:
          description: The list of job runs within the workflow.
          items:
            $ref: '#/components/schemas/JobRun'
          type: array
          x-order: 9
        lastUpdatedAt:
          description: The time the workflow run was last updated.
          format: date-time
          type: string
          x-order: 7
        orgId:
          description: The organization ID.
          type: string
          x-order: 2
        startedAt:
          description: The time the workflow run started.
          format: date-time
          type: string
          x-order: 5
        status:
          description: The current status of the workflow run.
          enum:
          - running
          - failed
          - succeeded
          type: string
          x-order: 4
          x-pulumi-model-property:
            enumTypeName: WorkflowRunStatus
            enumComments: WorkflowRunStatus describes the status of a workflow run.
            enumFieldComments:
            - WorkflowRunStatusRunning indicates that a workflow run is running.
            - WorkflowRunStatusFailed indicates that a workflow run has failed.
            - WorkflowRunStatusSucceeded indicates that a workflow run has succeeded.
        userId:
          description: The user ID who initiated the workflow run.
          type: string
          x-order: 3
      required:
      - finishedAt
      - id
      - jobTimeout
      - lastUpdatedAt
      - orgId
      - startedAt
      - status
      - userId
      type: object
    AppPolicyConfigSchema:
      description: PolicyConfigSchema defines the JSON schema of a particular Policy's configuration.
      properties:
        properties:
          additionalProperties:
            type: object
          description: Config property name to JSON Schema map.
          type: object
          x-order: 1
        required:
          description: Required config properties.
          items:
            type: string
          type: array
          x-order: 2
        type:
          description: Type defines the data type allowed for the schema.
          enum:
          - object
          type: string
          x-order: 3
          x-pulumi-model-property:
            enumTypeName: AppJSONSchemaType
            enumComments: JSONSchemaType in an enum of allowed data types for a schema.
            enumFieldComments:
            - Object is a dictionary.
      required:
      - type
      type: object
    TemplateDestination:
      description: TemplateDestination describes the destination for a template.
      properties:
        url:
          description: The destination URL.
          type: string
          x-order: 1
      required:
      - url
      type: object
    Organization:
      description: Organization represents a Pulumi organization.
      properties:
        avatarUrl:
          description: The URL of the organization's avatar image.
          type: string
          x-order: 3
        githubLogin:
          description: The GitHub login associated with the organization.
          type: string
          x-order: 1
        name:
          description: The name of the organization.
          type: string
          x-order: 2
        repos:
          description: The repositories belonging to the organization.
          items:
            $ref: '#/components/schemas/PulumiRepository'
          type: array
          x-order: 4
      required:
      - avatarUrl
      - githubLogin
      - name
      - repos
      type: object
    AppPolicyPackWithVersions:
      description: PolicyPackWithVersions details the specifics of a Policy Pack and all its available versions.
      properties:
        displayName:
          description: The display name
          type: string
          x-order: 2
        name:
          description: The name
          type: string
          x-order: 1
        versionTags:
          description: List of version tags
          items:
            type: string
          type: array
          x-order: 4
        versions:
          description: List of versions
          items:
            format: int64
            type: integer
          type: array
          x-order: 3
      required:
      - displayName
      - name
      - versionTags
      - versions
      type: object
    PermissionDescriptor:
      description: Base type for permission descriptors.
      discriminator:
        mapping:
          PermissionDescriptorAllow: '#/components/schemas/PermissionDescriptorAllow'
          PermissionDescriptorCompose: '#/components/schemas/PermissionDescriptorCompose'
          PermissionDescriptorCondition: '#/components/schemas/PermissionDescriptorCondition'
          PermissionDescriptorGroup: '#/components/schemas/PermissionDescriptorGroup'
          PermissionDescriptorIfThenElse: '#/components/schemas/PermissionDescriptorIfThenElse'
          PermissionDescriptorSelect: '#/components/schemas/PermissionDescriptorSelect'
        propertyName: __type
      properties:
        __type:
          type: string
      required:
      - __type
      type: object
    TemplateSource:
      description: A source containing one or more Pulumi templates.
      properties:
        destination:
          $ref: '#/components/schemas/TemplateDestination'
          description: Deprecated - use destinationURL instead.
          x-order: 7
        destinationURL:
          description: The destination URL for the template source.
          type: string
          x-order: 6
        error:
          description: An error message if the template source is invalid. Omitted or empty when the source is valid.
          type: string
          x-order: 3
        id:
          description: The unique identifier of the template source.
          type: string
          x-order: 1
        isValid:
          description: Whether the template source configuration is valid.
          type: boolean
          x-order: 2
        name:
          description: The human-readable name for this template source.
          type: string
          x-order: 4
        sourceURL:
          description: The source URL to fetch templates from.
          type: string
          x-order: 5
      required:
      - id
      - isValid
      - name
      - sourceURL
      type: object
    UpdateTeamRequest:
      description: UpdateTeamRequest modifies a team.
      properties:
        addEnvironmentPermission:
          $ref: '#/components/schemas/TeamEnvironmentSettings'
          description: An environment permission to add to the team.
          x-order: 8
        addStackPermission:
          $ref: '#/components/schemas/TeamStackPermission'
          description: A stack permission to add to the team.
          x-order: 5
        editEnvironmentPermission:
          $ref: '#/components/schemas/TeamEnvironmentSettings'
          description: An environment permission to edit on the team.
          x-order: 9
        editStackPermission:
          $ref: '#/components/schemas/TeamStackPermission'
          description: A stack permission to edit on the team.
          x-order: 6
        member:
          description: Member to be added or removed based on MemberAction.
          type: string
          x-order: 4
        memberAction:
          description: MemberAction is the action to perform.
          enum:
          - add
          - remove
          - promote
          - demote
          type: string
          x-order: 3
          x-pulumi-model-property:
            enumTypeName: MemberAction
            enumComments: MemberAction is an action to be performed to a team member.
            enumFieldComments:
            - MemberActionAdd adds a team member.
            - MemberActionRemove removes a team member.
            - MemberActionPromote promotes a team member to the role of admin.
            - MemberActionDemote demotes a team admin to the role of member.
        newDescription:
          description: The new description for the team.
          type: string
          x-order: 2
        newDisplayName:
          description: The new display name for the team.
          type: string
          x-order: 1
        removeEnvironment:
          $ref: '#/components/schemas/RemoveEnvironmentIdentifier'
          description: An environment to remove from the team.
          x-order: 10
        removeStack:
          $ref: '#/components/schemas/RemoveStackIdentifier'
          description: A stack to remove from the team.
          x-order: 7
      type: object
    AppCreateStackResponse:
      description: CreateStackResponse is the response from a create Stack request.
      properties:
        messages:
          description: Messages is a list of messages that should be displayed to the user.
          items:
            $ref: '#/components/schemas/AppMessage'
          type: array
          x-order: 1
      type: object
    ListRolesResponse:
      description: Response containing a list of roles.
      properties:
        roles:
          description: The list of roles
          items:
            $ref: '#/components/schemas/PermissionDescriptorRecord'
          type: array
          x-order: 1
      required:
      - roles
      type: object
    OrganizationMember:
      description: OrganizationMember defines a member of an organization.
      properties:
        created:
          description: When the member joined the organization.
          format: date-time
          type: string
          x-order: 3
        fgaRole:
          $ref: '#/components/schemas/FGARole'
          description: The role currently assigned to this member — either a built-in role (member, admin, billingManager) or a custom role. Falls back to the organization's default role if no role is assigned directly.
          x-order: 7
        knownToPulumi:
          description: KnownToPulumi returns if the organization member has a Pulumi account.
          type: boolean
          x-order: 4
        links:
          $ref: '#/components/schemas/MemberLinks'
          description: Links to the member in the Pulumi Console
          x-order: 6
        role:
          description: '**Deprecated:** Use `fgaRole` instead. The member''s built-in role within the organization. For members assigned a custom role, this is the closest built-in projection (`member`, `admin`, or `billingManager`) and may lose detail; `fgaRole` is authoritative.'
          enum:
          - none
          - member
          - admin
          - potential-member
          - stack-collaborator
          - billing-manager
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: OrganizationRole
            enumComments: OrganizationRole is an enum defining a member's role within an organization.
            enumFieldNames:
            - None
            - Member
            - Admin
            - PotentialMember
            - StackCollaborator
            - BillingManager
            enumFieldComments:
            - OrganizationRoleNone describes the role of non-members.
            - OrganizationRoleMember is the role for regular members.
            - OrganizationRoleAdmin is the role for admins.
            - 'OrganizationRolePotentialMember is the role for users who are explicitly

              not a member of the organization, but are a member of the backing org on

              the 3rd party identity provider. (i.e. they could join the org.)'
            - 'OrganizationRoleStackCollaborator is the role for users who are not a member

              of an organization, but have been explicitly granted access to some of the

              organization''s stacks. So they have limited permissions to access the org''s

              data.'
            - OrganizationRoleBillingManager is the role for billing admins.
        user:
          $ref: '#/components/schemas/UserInfo'
          description: The user information for this organization member.
          x-order: 2
        virtualAdmin:
          description: 'VirtualAdmin indicates that the member does not have admin access on the

            backing identity provider, but does have admin access to the Pulumi organization.'
          type: boolean
          x-order: 5
      required:
      - created
      - fgaRole
      - knownToPulumi
      - role
      - user
      - virtualAdmin
      type: object
    PulumiProject:
      description: 'PulumiProject describes a grouping of Pulumi stacks. It is based on Pulumi.yaml,

        but is specific to the Pulumi Service.'
      properties:
        description:
          description: The project description from Pulumi.yaml.
          type: string
          x-order: 6
        name:
          description: The name of the project.
          type: string
          x-order: 3
        orgName:
          description: The name of the organization that owns this project.
          type: string
          x-order: 1
        repoName:
          description: The repository name this project belongs to.
          type: string
          x-order: 2
        runtime:
          description: Optional tags from Pulumi.yaml.
          type: string
          x-order: 5
        settings:
          $ref: '#/components/schemas/PulumiProjectSettings'
          description: Optional project-level settings.
          x-order: 4
        stacks:
          description: The stacks belonging to this project.
          items:
            $ref: '#/components/schemas/PulumiStack'
          type: array
          x-order: 7
      required:
      - name
      - orgName
      - repoName
      - stacks
      type: object
    CustomerManagedKey:
      description: Represents customer managed key.
      properties:
        awsKms:
          $ref: '#/components/schemas/AwsKmsConfig'
          description: The aws kms
          x-order: 4
        id:
          description: The unique identifier
          type: string
          x-order: 1
        keyType:
          description: The key type
          enum:
          - aws_kms
          - service
          type: string
          x-order: 3
          x-pulumi-model-property:
            enumTypeName: KeyType
            enumComments: 'The type of encryption key used for secrets management. Valid values: ''aws_kms'' (AWS KMS), ''service'' (Pulumi-managed).'
            enumFieldNames:
            - AwsKms
            - Service
        name:
          description: The name
          type: string
          x-order: 2
        state:
          description: The current state
          type: string
          x-order: 5
      required:
      - id
      - keyType
      - name
      type: object
    AppUntypedDeployment:
      description: UntypedDeployment contains an inner, untyped deployment structure.
      properties:
        deployment:
          description: The opaque Pulumi deployment payload. Treated as a raw JSON value so the contents are preserved verbatim across client and server versions.
          type: object
          x-order: 3
        features:
          description: An optional list of features used by this deployment. The CLI will error when reading a deployment that uses a feature that is not supported by that version of the CLI. Only honored when `version` is 4 or greater.
          items:
            type: string
          type: array
          x-order: 2
        version:
          description: The schema version of the encoded deployment.
          format: int64
          type: integer
          x-order: 1
      type: object
    FGARole:
      description: A role assigned to an organization member, identified by ID and name. The role may be a built-in role or a custom role.
      properties:
        id:
          description: The unique identifier of the role.
          type: string
          x-order: 1
        modifiedAt:
          description: The timestamp when the role was last modified.
          format: date-time
          type: string
          x-order: 3
        name:
          description: The name of the role.
          type: string
          x-order: 2
      required:
      - id
      - modifiedAt
      - name
      type: object
    ResourceCountSummary:
      description: 'ResourceCountSummary represents a single point of summary for resources

        under management for an organization.'
      properties:
        day:
          description: The day of month. Ranges from 1 to 31.
          format: int64
          type: integer
          x-order: 3
        hour:
          description: The hour of the day. Ranges from 0 to 23.
          format: int64
          type: integer
          x-order: 5
        month:
          description: The month of the year. Ranges from 1 to 12.
          format: int64
          type: integer
          x-order: 2
        resourceHours:
          description: 'The RHUM, which is the number of hours the resources under management have

            been running. Calculated by getting the sum of all the resources for the

            given time frame. 1 resource hour = 1 Pulumi credit.'
          format: int64
          type: integer
          x-order: 7
        resources:
          description: 'The RUM (total number of resources under management at a given time).

            Calculated by getting the average of the all the resources for the given

            time frame.'
          format: int64
          type: integer
          x-order: 6
        weekNumber:
          description: The week number in the year with Sunday marking the start of the week. Ranges from 0-53.
          format: int64
          type: integer
          x-order: 4
        year:
          description: The 4-digit year.
          format: int64
          type: integer
          x-order: 1
      required:
      - resourceHours
      - resources
      - year
      type: object
    AngularGridAdvancedFilterModel:
      description: Represents angular grid advanced filter model.
      properties:
        conditions:
          description: List of conditions
          items:
            $ref: '#/components/schemas/AngularGridFilterModel'
          type: array
          x-order: 2
        type:
          description: The type
          type: string
          x-order: 1
      required:
      - conditions
      - type
      type: object
    AppMessage:
      description: Message is a message from the backend to be displayed to the user.
      properties:
        message:
          description: Message is the message to display to the user.
          type: string
          x-order: 2
        severity:
          description: Severity is the severity of the message.
          enum:
          - warning
          - error
          - info
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: AppMessageSeverity
            enumComments: Represents app message severity.
      required:
      - message
      type: object
    ChangeGateTargetInput:
      description: Input specification for change gate target - contains minimal identifiers for API requests
      properties:
        actionTypes:
          description: The action types this gate targets (currently only supports single action)
          items:
            enum:
            - update
            - open
            type: string
            x-pulumi-model-property:
              enumTypeName: ChangeGateTargetActionType
              enumComments: ChangeGateTargetActionType represents the type of action a gate governs
          type: array
          x-order: 3
        entityType:
          description: The entity type this gate targets
          enum:
          - environment
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: ChangeGateTargetEntityType
            enumComments: Represents change gate target entity type.
        qualifiedName:
          description: The qualified name of the entity this gate targets (e.g., 'project/env')
          type: string
          x-order: 2
      required:
      - actionTypes
      - entityType
      type: object
    GetChangeRequestResponse:
      allOf:
      - $ref: '#/components/schemas/ChangeRequest'
      - description: Response body for retrieving a change request with gate evaluation details.
        properties:
          gateEvaluation:
            $ref: '#/components/schemas/ChangeRequestGateEvaluation'
            description: The gate evaluation results for this change request
            x-order: 1
        required:
        - gateEvaluation
        type: object
    PolicyComplianceRow:
      description: PolicyComplianceRow represents a single row in a policy compliance report.
      properties:
        failingResources:
          description: Number of resources failing this policy
          format: int64
          type: integer
          x-order: 3
        governedResources:
          description: Total number of resources governed by this policy
          format: int64
          type: integer
          x-order: 4
        percentCompliant:
          description: Percentage of resources that are compliant (0-100)
          format: int64
          type: integer
          x-order: 5
        policyGroupName:
          description: The policy group this policy belongs to
          type: string
          x-order: 7
        policyGroupType:
          description: The type of the policy group this policy belongs to
          enum:
          - audit
          - preventative
          type: string
          x-order: 8
          x-pulumi-model-property:
            enumTypeName: PolicyGroupMode
            enumComments: PolicyGroupMode represents the enforcement mode for a policy group
        policyName:
          description: The name of the policy
          type: string
          x-order: 1
        policyPack:
          description: The policy pack this policy belongs to
          type: string
          x-order: 6
        severity:
          description: The severity level of the policy
          enum:
          - ''
          - low
          - medium
          - high
          - critical
          type: string
          x-order: 2
          x-pulumi-model-property:
            enumTypeName: AppPolicySeverity
            enumComments: Indicates the severity of a policy.
            enumFieldNames:
            - Unspecified
            - Low
            - Medium
            - High
            - Critical
      required:
      - failingResources
      - governedResources
      - percentCompliant
      - policyGroupName
      - policyGroupType
      - policyName
      - policyPack
      - severity
      type: object
    PulumiRepository:
      description: 'PulumiRepository is a grouping of "Projects". We also return a subset of the organization''s

        VCS repo with the same name, should it exist.'
      properties:
        name:
          description: The name of the repository.
          type: string
          x-order: 2
        orgName:
          description: The name of the organization that owns this repository.
          type: string
          x-order: 1
        projects:
          description: The projects within this repository.
          items:
            $ref: '#/components/schemas/PulumiProject'
          type: array
          x-order: 4
        vcsInfo:
          $ref: '#/components/schemas/VCSInfo'
          description: Version control system information for the repository.
          x-order: 3
      required:
      - name
      - orgName
      - projects
      type: object
    ListSAMLOrganizationAdminsResponse:
      description: Response containing a list of SAML organization administrators.
      properties:
        samlAdmins:
          description: The list of SAML administrators
          items:
            $ref: '#/components/schemas/UserInfo'
          type: array
          x-order: 1
      required:
      - samlAdmins
      type: object
    RegistryPolicyPack:
      description: 'RegistryPolicyPack represents the core metadata for a policy pack in the registry.

        This is the primary data structure returned by most registry API endpoints.'
      properties:
        accessLevel:
          description: AccessLevel is the client's level of access to this policy pack.
          enum:
          - full
          - view-only
          - deny
          type: string
          x-order: 7
          x-pulumi-model-property:
            enumTypeName: RegistryPolicyPackAccessLevel
            enumComments: The level of access a client has to a registry policy pack.
            enumFieldNames:
            - Full
            - ViewOnly
            - Deny
            enumFieldComments:
            - Full access to a policy pack (view + use)
            - Access to view a policy pack
            - No access to a policy pack
        displayName:
          description: 'DisplayName is a human-readable name for this policy pack.

            This is typically more descriptive than the technical name.'
          type: string
          x-order: 6
        enforcementLevels:
          description: EnforcementLevels are the client's allowed enforcement levels for this policy pack.
          items:
            enum:
            - advisory
            - mandatory
            - remediate
            - disabled
            type: string
            x-pulumi-model-property:
              enumTypeName: AppEnforcementLevel
              enumComments: EnforcementLevel indicates how a policy should be enforced
              enumFieldComments:
              - 'Advisory is an enforcement level where the resource is still created, but a

                message is displayed to the user for informational / warning purposes.'
              - Mandatory is an enforcement level that prevents a resource from being created.
              - Remediate is an enforcement level that fixes policy issues instead of issuing diagnostics.
              - Disabled is an enforcement level that disables the policy from being enforced.
          type: array
          x-order: 8
        id:
          description: 'ID is the unique identifier for this policy pack in the registry.

            This is a UUID that corresponds to the policy pack''s database ID.'
          type: string
          x-order: 1
        name:
          description: 'Name is the unique identifier for this policy pack within the publisher''s namespace.

            Policy pack names must be URL-safe and unique per publisher.'
          type: string
          x-order: 4
        publisher:
          description: 'Publisher is the organization or user that published this policy pack.

            This corresponds to the Pulumi organization name.'
          type: string
          x-order: 3
        source:
          description: 'Source indicates where this policy pack is hosted (e.g., "private", "pulumi").

            Currently, only "private" policy packs are supported.'
          type: string
          x-order: 2
        version:
          description: 'Version is the semantic version of this policy pack.

            This represents the latest or specific version being referenced.'
          type: string
          x-order: 5
      required:
      - accessLevel
      - displayName
      - enforcementLevels
      - id
      - name
      - publisher
      - source
      - version
      type: object
    AppCreatePolicyPackRequest:
      description: 'CreatePolicyPackRequest defines the request body for creating a new Policy

        Pack for an organization. The request contains the metadata related to the

        Policy Pack.'
      properties:
        description:
          description: A brief description of the policy pack.
          type: string
          x-order: 5
        displayName:
          description: A pretty name for the Policy Pack that is supplied by the package.
          type: string
          x-order: 2
        metadata:
          additionalProperties:
            type: string
          description: 'Metadata contains optional data about the environment performing the publish operation,

            e.g. the current source code control commit information.'
          type: object
          x-order: 10
        name:
          description: 'Name is a unique URL-safe identifier (at the org level) for the package.

            If the name has already been used by the organization, then the request will

            create a new version of the Policy Pack (incremented by one). This is supplied

            by the CLI.'
          type: string
          x-order: 1
        policies:
          description: 'The Policies outline the specific Policies in the package, and are derived

            from the package by the CLI.'
          items:
            $ref: '#/components/schemas/AppPolicy'
          type: array
          x-order: 4
        provider:
          description: The cloud provider/platform this policy pack is associated with, e.g. AWS, Azure, etc.
          type: string
          x-order: 7
        readme:
          description: README text about the policy pack.
          type: string
          x-order: 6
        repository:
          description: A URL to the repository where the policy pack is defined.
          type: string
          x-order: 9
        tags:
          description: Tags for this policy pack.
          items:
            type: string
          type: array
          x-order: 8
        versionTag:
          description: 'VersionTag is the semantic version of the Policy Pack. One a version is published, it

            cannot never be republished. Older clients will not have a version tag.'
          type: string
          x-order: 3
      required:
      - displayName
      - name
      - policies
      type: object
    TeamStackPermission:
      description: TeamStackPermission is the permission team membership grants to a stack.
      properties:
        permission:
          description: The permission level the team has on this stack (e.g., read, write, admin).
          enum:
          - 0
          - 101
          - 102
          - 103
          - 104
          format: int64
          type: integer
          x-order: 3
          x-pulumi-model-property:
            enumTypeName: StackPermission
            enumComments: 'StackPermission is a value describing the permission level a user has for a Pulumi stack.

              Like OrganizationRole, there is a total ordering of StackPermission values, where each value

              grants an additional layer of permissions. IMPORTANT: Do not rely on the numeric values for

              auth checks, instead, just refer to these as opaque names. e.g. use explicit matching in a

              case-statements instead of "if perm >= StackPermissionX". This prevents errors if we later

              add a new StackPermission "in between" two existing ones, but with a new, higher value.

              Previously, the StackPermission value was a series of bit flags, with each bit controlling

              a specific operation on the stack. However, that proved difficult to describe and maintain.

              So the newer, "fixed set" approach is used instead.

              The conversion from the legacy permission values and the new StackPermission values is done

              transparently, whenever data is read/written to the database. (Converting to the newer

              values as needed.) We will only be able to remove these legacy values after we deploy the

              code which can read both formats, and only writes the newer format.'
            enumFieldNames:
            - None
            - Read
            - Write
            - Admin
            - Creator
            enumFieldComments:
            - StackPermissionNone provides no access.
            - 'StackPermissionRead provides read-only access, including the ability to

              decrypt encrypted configuration secrets stored in the service.'
            - StackPermissionWrite provides read/write access to a stack.
            - 'StackPermissionAdmin provides admin-level access to the stack. For example,

              being able to run `pulumi destroy` or delete the stack.'
            - 'StackPermissionCreator is an implementation quirk of how we mark the user who created

              a stack. The value is not exported from this module, and is converted to StackPermissionAdmin

              before being returned to callers. However, in a few places we want to handle the user who

              created a stack a little differently, and this allows us to do so without exporting a separate

              "StackPermissionAdminWhoAlsoHappenedToCreateTheStackToo" value.'
        permissionSetName:
          description: Display name of the permission set for this stack, when available. Enables read-only entity access UI without requiring RoleRead.
          type: string
          x-order: 4
        projectName:
          description: The project containing the stack.
          type: string
          x-order: 1
        stackName:
          description: The stack within the project.
          type: string
          x-order: 2
      required:
      - permission
      - projectName
      - stackName
      type: object
    TeamMemberInfo:
      allOf:
      - $ref: '#/components/schemas/UserInfo'
      - description: TeamMemberInfo is a UserInfo extended to contain the TeamRole.
        properties:
          role:
            description: The member's role within the team.
            enum:
            - none
            - member
            - admin
            type: string
            x-order: 1
            x-pulumi-model-property:
              enumTypeName: TeamRole
              enumComments: TeamRole is the kind of role a user has in a team.
        required:
        - role
        type: object
    DeletedStack:
      description: DeletedStack represents a stack that has been deleted, including its metadata and last update information.
      properties:
        deletedAt:
          description: The Unix timestamp when the stack was deleted.
          format: int64
          type: integer
          x-order: 6
        id:
          description: The unique identifier of the deleted stack.
          type: string
          x-order: 1
        lastUpdate:
          $ref: '#/components/schemas/UpdateSummary'
          description: The last update summary for the stack before deletion.
          x-order: 7
        programId:
          description: The program identifier associated with the stack.
          type: string
          x-order: 2
        projectName:
          description: The name of the project the stack belonged to.
          type: string
          x-order: 3
        stackName:
          description: The name of the stack.
          type: string
          x-order: 4
        version:
          description: The version number of the stack.
          format: int64
          type: integer
          x-order: 5
      required:
      - deletedAt
      - id
      - lastUpdate
      - programId
      - projectName
      - stackName
      - version
      type: object
    OidcIssuerUpdateRequest:
      description: Request body for updating an existing OIDC issuer.
      properties:
        jwks:
          $ref: '#/components/schemas/JSONWebKeySet'
          description: The updated JSON Web Key Set for the OIDC issuer.
          x-order: 4
        maxExpiration:
          description: The updated maximum token expiration time in seconds.
          format: int64
          type: integer
          x-order: 3
        name:
          description: The updated display name of the OIDC issuer.
          type: string
          x-order: 1
        thumbprints:
          description: Updated SHA-1 certificate thumbprints used to verify the OIDC issuer's TLS certificate.
          items:
            type: string
          type: array
          x-order: 2
      type: object
    CreatePulumiTeamRequest:
      description: CreatePulumiTeamRequest creates a new Pulumi-backed team.
      properties:
        description:
          description: The description
          type: string
          x-order: 3
        displayName:
          description: The display name
          type: string
          x-order: 2
        name:
          description: The name
          type: string
          x-order: 1
      required:
      - description
      - displayName
      - name
      type: object
    GetResourceCountSummaryResponse:
      description: Response body for retrieving a summary of resource counts.
      properties:
        summary:
          description: The list of resource count summaries
          items:
            $ref: '#/components/schemas/ResourceCountSummary'
          type: array
          x-order: 1
      required:
      - summary
      type: object
    AppPolicyPackMetadata:
      description: PolicyPackMetadata is the metadata of a Policy Pack.
      properties:
        config:
          additionalProperties:
            type: object
          description: 'The configuration that is to be passed to the Policy Pack. This

            map ties Policies with their configuration.'
          type: object
          x-order: 5
        displayName:
          description: The display name
          type: string
          x-order: 2
        environments:
          description: References to ESC environments to use for this policy pack.
          items:
            type: string
          type: array
          x-order: 6
        name:
          description: The name
          type: string
          x-order: 1
        version:
          description: The version number
          format: int64
          type: integer
          x-order: 3
        versionTag:
          description: The version tag
          type: string
          x-order: 4
      required:
      - displayName
      - name
      - version
      - versionTag
      type: object
    UpdateServiceMetadataRequest:
      description: Request for updating a services metadata.
      properties:
        description:
          description: an optional description of the service
          type: string
          x-order: 2
        name:
          description: the name of the service
          type: string
          x-order: 1
        properties:
          description: an optional list of properties to set on the service
          items:
            $ref: '#/components/schemas/ServiceProperty'
          type: array
          x-order: 3
      type: object
    ChangeGateRuleOutput:
      description: Output representation of change gate rule - contains full details for API responses
      discriminator:
        mapping:
          approval_required: '#/components/schemas/ChangeGateApprovalRuleOutput'
        propertyName: ruleType
      properties:
        ruleType:
          type: string
      required:
      - ruleType
      type: object
    GetPolicyIssueResponse:
      description: Response body for retrieving a policy issue and its associated policy details.
      properties:
        policy:
          $ref: '#/components/schemas/AppPolicy'
          description: The policy definition that caused this issue. May be null if the policy has been deleted or is unavailable.
          x-order: 2
        policyIssue:
          $ref: '#/components/schemas/PolicyIssue'
          description: The policy issue details
          x-order: 1
        policyPack:
          $ref: '#/components/schemas/RegistryPolicyPack'
          description: The registry policy pack metadata. May be null if the policy pack is unavailable.
          x-order: 3
      required:
      - policyIssue
      type: object
    ListUsersWithRoleResponse:
      description: ListUsersWithRoleResponse is the shape of the response when listing users with a given role within an organization.
      properties:
        users:
          description: Users that have been explicitly configured to the given role (ie, not configured via default role).
          items:
            $ref: '#/components/schemas/UserInfo'
          type: array
          x-order: 1
      required:
      - users
      type: object
    OidcIssuerRegistrationResponse:
      description: Response body after registering an OIDC issuer.
      properties:
        created:
          description: The ISO 8601 timestamp when the OIDC issuer was created.
          type: string
          x-order: 8
        id:
          description: The unique identifier of the registered OIDC issuer.
          type: string
          x-order: 1
        issuer:
          description: The OIDC issuer identifier, typically a URL that uniquely identifies the identity provider.
          type: string
          x-order: 4
        jwks:
          $ref: '#/components/schemas/JSONWebKeySet'
          description: The JSON Web Key Set for the OIDC issuer.
          x-order: 6
        lastUsed:
          description: The ISO 8601 timestamp when the OIDC issuer was last used for token exchange.
          type: string
          x-order: 10
        maxExpiration:
          description: The maximum token expiration time in seconds.
          format: int64
          type: integer
          x-order: 7
        modified:
          description: The ISO 8601 timestamp when the OIDC issuer was last modified.
          type: string
          x-order: 9
        name:
          description: The display name of the OIDC issuer.
          type: string
          x-order: 2
        thumbprints:
          description: SHA-1 certificate thumbprints used to verify the OIDC issuer's TLS certificate.
          items:
            type: string
          type: array
          x-order: 5
        url:
          description: The URL of the OIDC issuer.
          type: string
          x-order: 3
      required:
      - id
      - issuer
      - name
      - url
      type: object
    OrganizationAuditLogExportSettings:
      description: OrganizationAuditLogExportSettings is an organization's current audit log export configuration.
      properties:
        enabled:
          description: Whether audit log export is currently active. May be paused automatically if the configured destination repeatedly fails to authenticate.
          type: boolean
          x-order: 1
        lastResult:
          $ref: '#/components/schemas/AuditLogExportResult'
          description: The result of the last audit log export attempt.
          x-order: 3
        s3Config:
          $ref: '#/components/schemas/AuditLogsExportS3Config'
          description: The S3 configuration for exporting audit logs.
          x-order: 2
      required:
      - enabled
      - lastResult
      - s3Config
      type: object
    AwsKmsConfig:
      description: Configuration for using AWS KMS as a secrets encryption provider.
      properties:
        keyArn:
          description: ARN of the KMS key to use for encrypting/decrypting secrets.
          type: string
          x-order: 2
        roleArn:
          description: ARN of the IAM role to assume for KMS operations.
          type: string
          x-order: 1
      required:
      - keyArn
      - roleArn
      type: object
    UpdateSAMLOrganizationRequest:
      description: 'UpdateSAMLOrganizationRequest is the request type for an org admin to update a SAML-backed organization.

        Non-null fields will replace the corresponding fields of the organization.'
      properties:
        newIdpSsoDescriptor:
          description: The new IDP SSO descriptor XML for the SAML configuration.
          type: string
          x-order: 1
      type: object
    RbacScopeGroup:
      description: RbacScopeGroup represents a group of scopes for a resource group
      properties:
        name:
          description: The name of this scope group.
          enum:
          - Stacks
          - Stack deployments
          - Stack webhooks
          - Stack tags
          - Stack deployment schedules
          - Agent pools
          - Environments
          - Environment webhooks
          - Environment tags
          - Environment versions
          - Environment schedules
          - Environment secrets rotation
          - Accounts
          - Scans
          - Policy queue
          - Policy evaluator
          - Stack management
          - Environment management
          - Insights account management
          - Insights policy management
          - Organization
          - Membership
          - Organization access tokens
          - Teams
          - SSO
          - Audit logs
          - Roles
          - Search
          - Copilot
          - Organization annotations
          - OIDC
          - Templates
          - Deployments
          - Organization webhooks
          - Approvals
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: RbacScopeGroupName
            enumComments: RbacScopeGroupName enumerates the names of RBAC scope groups for organizing permissions by resource type.
            enumFieldNames:
            - Stacks
            - StackDeployments
            - StackWebhooks
            - StackTags
            - StackDeploySchedules
            - AgentPools
            - Environments
            - EnvironmentWebhooks
            - EnvironmentTags
            - EnvironmentVersions
            - EnvironmentSchedules
            - EnvironmentSecretsRotation
            - InsightsAccounts
            - InsightsScan
            - InsightsPolicyQueue
            - InsightsPolicyEvaluator
            - StackManagement
            - EnvironmentManagement
            - InsightsAccountManagement
            - InsightsPolicyManagement
            - Organization
            - Membership
            - OrganizationTokens
            - Teams
            - SSO
            - AuditLogs
            - Roles
            - Search
            - Copilot
            - Annotations
            - Oidc
            - Templates
            - OrgDeployments
            - OrgWebhooks
            - ChangeRequests
        scopes:
          description: The list of scopes in this group.
          items:
            $ref: '#/components/schemas/RbacScope'
          type: array
          x-order: 2
      required:
      - name
      - scopes
      type: object
    AngularGridFilterModel:
      description: Represents angular grid filter model.
      properties:
        colId:
          description: The col identifier
          type: string
          x-order: 2
        conditions:
          description: List of conditions
          items:
            $ref: '#/components/schemas/AngularGridFilterModel'
          type: array
          x-order: 5
        filter:
          description: The filter expression
          type: string
          x-order: 1
        filterType:
          description: The filter type
          type: string
          x-order: 3
        type:
          description: The type
          type: string
          x-order: 4
      required:
      - colId
      - filter
      - filterType
      - type
      type: object
    AppPolicy:
      description: Policy defines the metadata for an individual Policy within a Policy Pack.
      properties:
        configSchema:
          $ref: '#/components/schemas/AppPolicyConfigSchema'
          description: The JSON schema for the Policy's configuration.
          x-order: 6
        description:
          description: Description is used to provide more context about the purpose of the policy.
          type: string
          x-order: 3
        displayName:
          description: The display name
          type: string
          x-order: 2
        enforcementLevel:
          description: The enforcement level
          enum:
          - advisory
          - mandatory
          - remediate
          - disabled
          type: string
          x-order: 4
          x-pulumi-model-property:
            enumTypeName: AppEnforcementLevel
            enumComments: EnforcementLevel indicates how a policy should be enforced
            enumFieldComments:
            - 'Advisory is an enforcement level where the resource is still created, but a

              message is displayed to the user for informational / warning purposes.'
            - Mandatory is an enforcement level that prevents a resource from being created.
            - Remediate is an enforcement level that fixes policy issues instead of issuing diagnostics.
            - Disabled is an enforcement level that disables the policy from being enforced.
        framework:
          $ref: '#/components/schemas/AppPolicyComplianceFramework'
          description: The compliance framework that this policy belongs to.
          x-order: 8
        message:
          description: Message is the message that will be displayed to end users when they violate this policy.
          type: string
          x-order: 5
        name:
          description: Unique URL-safe name for the policy.  This is unique to a specific version of a Policy Pack.
          type: string
          x-order: 1
        remediationSteps:
          description: A description of the steps to take to remediate a policy violation.
          type: string
          x-order: 10
        severity:
          description: The severity of the policy.
          enum:
          - ''
          - low
          - medium
          - high
          - critical
          type: string
          x-order: 7
          x-pulumi-model-property:
            enumTypeName: AppPolicySeverity
            enumComments: Indicates the severity of a policy.
            enumFieldNames:
            - Unspecified
            - Low
            - Medium
            - High
            - Critical
        tags:
          description: Tags associated with the policy.
          items:
            type: string
          type: array
          x-order: 9
        url:
          description: A URL to more information about the policy.
          type: string
          x-order: 11
      required:
      - description
      - displayName
      - enforcementLevel
      - message
      - name
      type: object
    ListPolicyViolationsV2Response:
      description: Response containing a paginated list of policy violations (v2).
      properties:
        continuationToken:
          description: Continuation token for pagination
          type: string
          x-order: 2
        policyViolations:
          description: The list of policy violations
          items:
            $ref: '#/components/schemas/PolicyViolationV2'
          type: array
          x-order: 1
      required:
      - policyViolations
      type: object
    PolicyIssueFilterValue:
      description: PolicyIssueFilterValue represents a filter option with its count of matching policy issues.
      properties:
        count:
          description: The count of policy issues matching this filter value.
          format: int64
          type: integer
          x-order: 2
        name:
          description: The name of the filter value.
          type: string
          x-order: 1
      required:
      - count
      - name
      type: object
    StepRun:
      description: StepRun contains information about a step run.
      properties:
        lastUpdated:
          description: The timestamp when the step was last updated.
          format: date-time
          type: string
          x-order: 4
        name:
          description: The name of the step.
          type: string
          x-order: 1
        started:
          description: The timestamp when the step started.
          format: date-time
          type: string
          x-order: 3
        status:
          description: The current status of the step.
          enum:
          - not-started
          - running
          - failed
          - succeeded
          type: string
          x-order: 2
          x-pulumi-model-property:
            enumTypeName: StepStatus
            enumComments: StepStatus describes the status of a step in a workflow job run.
            enumFieldNames:
            - NotStarted
            - Running
            - Failed
            - Succeeded
            enumFieldComments:
            - StepStatusNotStarted indicates that a step has not yet started.
            - StepStatusRunning indicates that a step is running.
            - StepStatusFailed indicates that a step has failed.
            - StepStatusSucceeded indicates that a step has succeeded.
      required:
      - name
      - status
      type: object
    UpdatePolicyGroupRequest:
      allOf:
      - $ref: '#/components/schemas/AppUpdatePolicyGroupRequest'
      - description: UpdatePolicyGroupRequest modifies a Policy Group.
        properties:
          addInsightsAccount:
            $ref: '#/components/schemas/InsightsAccount'
            description: An Insights account to add to the policy group.
            x-order: 1
          agentPoolId:
            description: Agent pool ID for audit policy evaluation. Set to empty string to clear, omit to leave unchanged.
            type: string
            x-order: 3
          removeInsightsAccount:
            $ref: '#/components/schemas/InsightsAccount'
            description: An Insights account to remove from the policy group.
            x-order: 2
        type: object
    OrganizationFeatures:
      description: OrganizationFeatures represents paid features for organizations.
      properties:
        agentIntegrationCatalogEnabled:
          description: Whether the agent integration catalog is enabled.
          type: boolean
          x-order: 50
        agentPoolRegistrationEnabled:
          description: Whether agent pool registration is enabled for self-hosted deployments.
          type: boolean
          x-order: 18
        agentScheduledTasksEnabled:
          description: Whether agent automations are enabled.
          type: boolean
          x-order: 51
        aiAgentsEnabled:
          description: Whether AI agents (Pulumi Copilot) are enabled.
          type: boolean
          x-order: 40
        aiReviewCodeAccessEnabled:
          description: Whether AI review code access is enabled.
          type: boolean
          x-order: 52
        aleEnabled:
          description: Whether audit log export (ALE) is enabled.
          type: boolean
          x-order: 5
        approvalsEnabled:
          description: Whether change request approvals are enabled.
          type: boolean
          x-order: 32
        auditLogUIFilteringEnabled:
          description: Whether audit log UI filtering is enabled.
          type: boolean
          x-order: 22
        auditLogsEnabled:
          description: Whether audit logs are enabled for the organization.
          type: boolean
          x-order: 1
        bitbucketVCSEnabled:
          description: Whether Bitbucket VCS integration is enabled.
          type: boolean
          x-order: 54
        bringYourOwnKeyEnabled:
          description: Whether bring-your-own-key encryption is enabled.
          type: boolean
          x-order: 31
        crossGuardEnabled:
          description: Whether CrossGuard policy enforcement is enabled.
          type: boolean
          x-order: 2
        customRoleCondition:
          description: Whether custom role conditions are enabled.
          type: boolean
          x-order: 42
        customRolesEnabled:
          description: Whether custom RBAC roles are enabled.
          type: boolean
          x-order: 26
        customTemplatesEnabled:
          description: Whether custom templates are enabled.
          type: boolean
          x-order: 12
        customVCSEnabled:
          description: Whether custom VCS integrations are enabled.
          type: boolean
          x-order: 53
        dashboardOnboardingUIEnabled:
          description: Whether the dashboard onboarding UI is enabled.
          type: boolean
          x-order: 19
        dependencyCachingEnabled:
          description: Whether dependency caching for deployments is enabled.
          type: boolean
          x-order: 23
        deployEnabled:
          description: Whether Pulumi Deployments is enabled.
          type: boolean
          x-order: 6
        discoveredStacksEnabled:
          description: Whether discovered stacks are enabled.
          type: boolean
          x-order: 49
        driftDetectionEnabled:
          description: Whether drift detection is enabled.
          type: boolean
          x-order: 20
        environmentRevisionTagsEnabled:
          description: Whether environment revision tags are enabled.
          type: boolean
          x-order: 15
        environmentSecretRotationEnabled:
          description: Whether environment secret rotation is enabled.
          type: boolean
          x-order: 27
        environmentsEnabled:
          description: Whether Pulumi ESC environments are enabled.
          type: boolean
          x-order: 14
        environmentsRestoreEnabled:
          description: Whether restoring deleted environments is enabled.
          type: boolean
          x-order: 24
        escEditorRevampEnabled:
          description: Whether the ESC editor revamp is enabled.
          type: boolean
          x-order: 35
        escOnboardingAzureOAuthClientEnabled:
          description: Whether the Azure OAuth client for ESC onboarding is enabled.
          type: boolean
          x-order: 36
        escOnboardingEnabled:
          description: Whether ESC onboarding is enabled.
          type: boolean
          x-order: 33
        escOnboardingGcpOAuthClientEnabled:
          description: Whether the GCP OAuth client for ESC onboarding is enabled.
          type: boolean
          x-order: 37
        escOnboardingV2Enabled:
          description: Whether ESC onboarding v2 is enabled.
          type: boolean
          x-order: 34
        fixDriftWithNeoEnabled:
          description: Whether fixing drift with Neo is enabled.
          type: boolean
          x-order: 56
        getStartedOnboardEnabled:
          description: Whether the getting started onboarding flow is enabled.
          type: boolean
          x-order: 47
        ghAppDetailedDiffEnabled:
          description: Whether the GitHub App detailed diff view is enabled.
          type: boolean
          x-order: 44
        gitHubEnterpriseIntegrationEnabled:
          description: Whether GitHub Enterprise integration is enabled.
          type: boolean
          x-order: 17
        iacCloudImportEnabled:
          description: Whether IaC cloud import is enabled.
          type: boolean
          x-order: 30
        insightsAutoPolicyPacksEnabled:
          description: Whether the Insights auto policy packs experience (including the bulk account discover wizard) is enabled.
          type: boolean
          x-order: 55
        insightsMonetizationEnabled:
          description: Whether Insights monetization features are enabled.
          type: boolean
          x-order: 28
        integrationAssistantEnabled:
          description: Whether the integration assistant is enabled.
          type: boolean
          x-order: 4
        legacyDeploymentsOrgToken:
          description: Whether the organization uses a legacy org token for deployments.
          type: boolean
          x-order: 16
        neoPlanModeEnabled:
          description: Whether Neo plan mode is enabled.
          type: boolean
          x-order: 46
        neoReadOnlyEnabled:
          description: Whether Neo read-only permission mode is enabled.
          type: boolean
          x-order: 48
        neoServerSideApprovalsEnabled:
          description: Whether Neo server side approvals is enabled.
          type: boolean
          x-order: 45
        neoTaskSharingEnabled:
          description: Whether Copilot task sharing is enabled.
          type: boolean
          x-order: 43
        nlpSearchEnabled:
          description: Whether natural language search is enabled.
          type: boolean
          x-order: 11
        pangeaAccountsScanPageEnabled:
          description: Whether the Pangea accounts scan page is enabled.
          type: boolean
          x-order: 25
        policyIssueManagementEnabled:
          description: Whether policy issue management is enabled.
          type: boolean
          x-order: 39
        policyManagementV2Enabled:
          description: Whether policy management v2 is enabled.
          type: boolean
          x-order: 38
        propertySearchUIEnabled:
          description: Whether the property search UI is enabled.
          type: boolean
          x-order: 10
        resourceExportEnabled:
          description: Whether resource export is enabled.
          type: boolean
          x-order: 9
        resourceSearchEnabled:
          description: Whether resource search is enabled.
          type: boolean
          x-order: 8
        restoreStacksEnabled:
          description: Whether restoring deleted stacks is enabled.
          type: boolean
          x-order: 13
        scimEnabled:
          description: Whether SCIM provisioning is enabled.
          type: boolean
          x-order: 7
        selfHostedDeploymentsEnabled:
          description: Whether self-hosted deployment agents are enabled.
          type: boolean
          x-order: 21
        selfServeIDPRemoval:
          description: Whether self-serve IDP removal is enabled.
          type: boolean
          x-order: 29
        themingEnabled:
          description: Whether UI theming is enabled.
          type: boolean
          x-order: 41
        webhooksEnabled:
          description: Whether webhooks are enabled for the organization.
          type: boolean
          x-order: 3
      required:
      - agentIntegrationCatalogEnabled
      - agentPoolRegistrationEnabled
      - agentScheduledTasksEnabled
      - aiAgentsEnabled
      - aiReviewCodeAccessEnabled
      - aleEnabled
      - approvalsEnabled
      - auditLogUIFilteringEnabled
      - auditLogsEnabled
      - bitbucketVCSEnabled
      - bringYourOwnKeyEnabled
      - crossGuardEnabled
      - customRoleCondition
      - customRolesEnabled
      - customTemplatesEnabled
      - customVCSEnabled
      - dashboardOnboardingUIEnabled
      - dependencyCachingEnabled
      - deployEnabled
      - discoveredStacksEnabled
      - driftDetectionEnabled
      - environmentRevisionTagsEnabled
      - environmentSecretRotationEnabled
      - environmentsEnabled
      - environmentsRestoreEnabled
      - escEditorRevampEnabled
      - escOnboardingAzureOAuthClientEnabled
      - escOnboardingEnabled
      - escOnboardingGcpOAuthClientEnabled
      - escOnboardingV2Enabled
      - fixDriftWithNeoEnabled
      - getStartedOnboardEnabled
      - ghAppDetailedDiffEnabled
      - gitHubEnterpriseIntegrationEnabled
      - iacCloudImportEnabled
      - insightsAutoPolicyPacksEnabled
      - insightsMonetizationEnabled
      - integrationAssistantEnabled
      - legacyDeploymentsOrgToken
      - neoPlanModeEnabled
      - neoReadOnlyEnabled
      - neoServerSideApprovalsEnabled
      - neoTaskSharingEnabled
      - nlpSearchEnabled
      - pangeaAccountsScanPageEnabled
      - policyIssueManagementEnabled
      - policyManagementV2Enabled
      - propertySearchUIEnabled
      - resourceExportEnabled
      - resourceSearchEnabled
      - restoreStacksEnabled
      - scimEnabled
      - selfHostedDeploymentsEnabled
      - selfServeIDPRemoval
      - themingEnabled
      - webhooksEnabled
      type: object
    Webhook:
      description: 'Webhook describes a webhook registered with the Pulumi Service. It may

        be registered to either an Organization, Stack or Environment.'
      properties:
        active:
          description: Whether the webhook is active and will receive deliveries.
          type: boolean
          x-order: 9
        displayName:
          description: The human-readable display name shown in the UI.
          type: string
          x-order: 6
        envName:
          description: The environment name. Set when the webhook is scoped to a specific environment.
          type: string
          x-order: 4
        filters:
          description: Specific event types this webhook subscribes to. If empty, all events are delivered.
          items:
            type: string
          type: array
          x-order: 11
        format:
          description: The format of the webhook payload (e.g., 'raw', 'slack', 'ms_teams').
          type: string
          x-order: 10
        groups:
          description: Event groups this webhook subscribes to (e.g., 'stacks', 'deployments').
          items:
            type: string
          type: array
          x-order: 12
        name:
          description: The unique identifier name for the webhook within its scope.
          type: string
          x-order: 5
        organizationName:
          description: The organization that owns this webhook.
          type: string
          x-order: 1
        payloadUrl:
          description: The URL to which webhook payloads are delivered.
          type: string
          x-order: 7
        projectName:
          description: The project name. Set when the webhook is scoped to a specific stack.
          type: string
          x-order: 2
        secret:
          description: Secret will be omitted when returned from the service.
          type: string
          x-order: 8
        stackName:
          description: The stack name. Set when the webhook is scoped to a specific stack.
          type: string
          x-order: 3
      required:
      - active
      - displayName
      - name
      - organizationName
      - payloadUrl
      type: object
    JSONWebKey:
      description: A JSON Web Key (JWK) as defined by RFC 7517.
      properties:
        Algorithm:
          description: 'The ''alg'' parameter: the algorithm intended for use with this key (e.g. RS256, ES256).'
          type: string
          x-order: 3
        CertificateThumbprintSHA1:
          description: The SHA-1 thumbprint of the X.509 certificate
          items:
            format: byte
            type: string
          type: array
          x-order: 7
        CertificateThumbprintSHA256:
          description: The SHA-256 thumbprint of the X.509 certificate
          items:
            format: byte
            type: string
          type: array
          x-order: 8
        Certificates:
          description: The X.509 certificate chain
          items:
            $ref: '#/components/schemas/X509Certificate'
          type: array
          x-order: 5
        CertificatesURL:
          $ref: '#/components/schemas/NetURL'
          description: The URL for the X.509 certificate chain
          x-order: 6
        Key:
          description: The cryptographic key material. Structure depends on the key type (RSA, EC, etc.).
          type: object
          x-order: 1
        KeyID:
          description: 'The ''kid'' parameter: a unique identifier for the key.'
          type: string
          x-order: 2
        Use:
          description: 'The ''use'' parameter: ''sig'' for signing or ''enc'' for encryption.'
          type: string
          x-order: 4
      required:
      - Algorithm
      - CertificateThumbprintSHA1
      - CertificateThumbprintSHA256
      - Certificates
      - CertificatesURL
      - Key
      - KeyID
      - Use
      type: object
    UpdateChangeGateRequest:
      description: UpdateChangeGateRequest represents the request to update an existing change gate
      properties:
        enabled:
          description: Whether the change gate is enabled
          type: boolean
          x-order: 2
        name:
          description: Name of the change gate
          type: string
          x-order: 1
        rule:
          $ref: '#/components/schemas/ChangeGateRuleInput'
          description: Rule configuration for the gate
          x-order: 4
        target:
          $ref: '#/components/schemas/ChangeGateTargetInput'
          description: Target configuration for the gate
          x-order: 3
      required:
      - enabled
      - name
      - rule
      - target
      type: object
    Aggregation:
      description: Aggregation collects the top 5 aggregated values for the requested dimension.
      properties:
        others:
          description: The others
          format: int64
          type: integer
          x-order: 1
        results:
          description: List of results
          items:
            $ref: '#/components/schemas/AggregationBucket'
          type: array
          x-order: 2
      type: object
    JSONWebKeySet:
      description: A JSON Web Key Set (JWKS) as defined by RFC 7517.
      properties:
        keys:
          description: The set of JSON Web Keys
          items:
            $ref: '#/components/schemas/JSONWebKey'
          type: array
          x-order: 1
      required:
      - keys
      type: object
    GetPolicyComplianceResultsResponse:
      description: Response for policy compliance results
      properties:
        columns:
          description: Column names (policy pack names) in order
          items:
            type: string
          type: array
          x-order: 1
        continuationToken:
          description: Continuation token for next page
          type: string
          x-order: 3
        rows:
          description: List of policy compliance result rows
          items:
            $ref: '#/components/schemas/PolicyComplianceResult'
          type: array
          x-order: 2
      required:
      - columns
      - rows
      type: object
    ServiceItemUpdate:
      description: An update that the item may have in it's history.
      properties:
        message:
          description: the message to show alongside the timestamp
          type: string
          x-order: 2
        success:
          description: used to toggle a status icon for the update
          type: boolean
          x-order: 3
        timestamp:
          description: the timestamp of the last update
          format: date-time
          type: string
          x-order: 1
      required:
      - message
      - timestamp
      type: object
    AngularGridSortModelItem:
      description: Represents angular grid sort model item.
      properties:
        colId:
          description: Column Id to apply the sort to.
          type: string
          x-order: 1
        sort:
          description: Sort direction
          type: string
          x-order: 2
      required:
      - colId
      - sort
      type: object
    CreateServiceRequest:
      description: 'Request for creating a new service with an optional list

        of items to populate the service with after creation.'
      properties:
        description:
          description: an optional description of the service
          type: string
          x-order: 4
        items:
          description: an optional list of items to add during service creation
          items:
            $ref: '#/components/schemas/AddServiceItem'
          type: array
          x-order: 5
        name:
          description: the name of the service
          type: string
          x-order: 3
        ownerName:
          description: the service owner name
          type: string
          x-order: 2
        ownerType:
          description: the service owner type
          type: string
          x-order: 1
        properties:
          description: an optional list of properties to set on the service
          items:
            $ref: '#/components/schemas/ServiceProperty'
          type: array
          x-order: 6
      required:
      - description
      - items
      - name
      - ownerName
      - ownerType
      - properties
      type: object
    RemoveEnvironmentIdentifier:
      description: Identifier used when removing an environment from a team.
      properties:
        envName:
          description: The name of the environment to remove.
          type: string
          x-order: 2
        projectName:
          description: The name of the project containing the environment.
          type: string
          x-order: 1
      required:
      - envName
      - projectName
      type: object
    ChangeGateRuleEvaluation:
      description: Represents change gate rule evaluation.
      discriminator:
        mapping:
          approval_required: '#/components/schemas/ChangeGateApprovalRuleEvaluation'
        propertyName: ruleType
      properties:
        ruleType:
          type: string
      required:
      - ruleType
      type: object
    ListAccessTokensResponse:
      description: ListAccessTokensResponse is the shape of the response when listing access tokens for a user.
      properties:
        tokens:
          description: The list of access tokens
          items:
            $ref: '#/components/schemas/AccessToken'
          type: array
          x-order: 1
      required:
      - tokens
      type: object
    AngularGridColumn:
      description: Represents angular grid column.
      properties:
        aggFunc:
          description: The agg func
          type: string
          x-order: 4
        displayName:
          description: The display name
          type: string
          x-order: 2
        field:
          description: The field
          type: string
          x-order: 3
        id:
          description: The unique identifier
          type: string
          x-order: 1
      required:
      - displayName
      - id
      type: object
    VCSInfo:
      description: VCSInfo is the info of the VCS, with which a particular program is associated.
      properties:
        kind:
          description: The kind of VCS provider.
          type: string
          x-order: 3
        owner:
          description: The owner of the repository.
          type: string
          x-order: 1
        repoName:
          description: The name of the repository.
          type: string
          x-order: 2
      required:
      - kind
      - owner
      - repoName
      type: object
    ChangeRequestApplyResult:
      description: 'ChangeRequestApplyResult represents the result of applying a change request.

        It provides the necessary information for the frontend to navigate to the updated entity.'
      properties:
        entityUrl:
          description: API endpoint for fetching the updated entity
          type: string
          x-order: 1
        message:
          description: Optional details about the apply operation
          type: string
          x-order: 2
      required:
      - entityUrl
      type: object
    ResponseAuditLogs:
      description: 'ResponseAuditLogs represents the audit event logs response given

        when listing audit log events. Contains a continuation token for

        pagination as well as a list of the AuditLogEvent objects.'
      properties:
        auditLogEvents:
          description: The list of audit log events.
          items:
            $ref: '#/components/schemas/AuditLogEvent'
          type: array
          x-order: 2
        continuationToken:
          description: A continuation token for paginating through audit log results.
          type: string
          x-order: 1
      required:
      - auditLogEvents
      type: object
    ListChangeGatesResponse:
      description: Response containing a paginated list of change gates.
      properties:
        continuationToken:
          description: Continuation token for pagination. If null, there are no more results available.
          type: string
          x-order: 2
        gates:
          description: List of change gates
          items:
            $ref: '#/components/schemas/ChangeGate'
          type: array
          x-order: 1
      required:
      - continuationToken
      - gates
      type: object
    StackUsage:
      description: StackUsage contains information about a stack that uses a specific package.
      properties:
        lastUpdate:
          $ref: '#/components/schemas/StackUpdate'
          description: Information about the most recent stack update, if available.
          x-order: 6
        projectName:
          description: The name of the project containing this stack.
          type: string
          x-order: 3
        providerUrn:
          description: The full provider URN for this stack.
          type: string
          x-order: 5
        stackId:
          description: The unique identifier of the stack.
          type: string
          x-order: 2
        stackName:
          description: The name of the stack.
          type: string
          x-order: 1
        version:
          description: The parsed semantic version of the package used, if available.
          type: string
          x-order: 4
      type: object
    AddChangeRequestCommentRequest:
      description: AddChangeRequestCommentRequest adds a comment to a change request without approving or closing it.
      properties:
        comment:
          description: The comment text to add to the change request.
          type: string
          x-order: 1
      required:
      - comment
      type: object
    PulumiStack:
      description: 'PulumiStack contains a name and some information for the frontend to construct a route to the details page. The

        custom routing parameters are here to help land the new identity model in an iterative fashion and long term will

        be removed.'
      properties:
        driftDetected:
          description: Whether the last drift detection run found differences between the desired and actual state.
          type: boolean
          x-order: 9
        hasDeploymentSettings:
          description: Whether the stack has Pulumi Deployments settings configured (source, OIDC, etc.).
          type: boolean
          x-order: 8
        lastUpdate:
          $ref: '#/components/schemas/UpdateSummary'
          description: Summary of the last update to the stack. nil if never updated.
          x-order: 3
        name:
          description: The name of the stack.
          type: string
          x-order: 2
        programId:
          description: Unique identifier for the stack.
          type: string
          x-order: 1
        protectedByPolicy:
          description: If true, the stack has at least one Policy Pack enforced.
          type: boolean
          x-order: 7
        routingProject:
          description: The project name used for routing to the stack details page.
          type: string
          x-order: 5
        routingRepo:
          description: The repository name used for routing to the stack details page.
          type: string
          x-order: 4
        tags:
          additionalProperties:
            type: string
          description: Tags associated with the stack as key-value pairs.
          type: object
          x-order: 6
      required:
      - driftDetected
      - hasDeploymentSettings
      - name
      - programId
      - protectedByPolicy
      - routingProject
      - routingRepo
      type: object
    AppCreatePolicyPackResponse:
      description: 'CreatePolicyPackResponse is the response from creating a Policy Pack. It returns

        a URI to upload the Policy Pack zip file to.'
      properties:
        requiredHeaders:
          additionalProperties:
            type: string
          description: RequiredHeaders represents headers that the CLI must set in order for the upload to succeed.
          type: object
          x-order: 3
        uploadURI:
          description: The upload URI
          type: string
          x-order: 2
        version:
          description: The version number
          format: int64
          type: integer
          x-order: 1
      required:
      - uploadURI
      - version
      type: object
    NetIPNet:
      description: NetIPNet represents an IP network with an address and subnet mask.
      properties:
        IP:
          description: The IP address of the network.
          items:
            format: byte
            type: string
          type: array
          x-order: 1
        Mask:
          description: The subnet mask of the network.
          items:
            format: byte
            type: string
          type: array
          x-order: 2
      required:
      - IP
      - Mask
      type: object
    ListServicesResponse:
      description: Response when listing services for a user.
      properties:
        continuationToken:
          description: 'ContinuationToken is an opaque value the client can send to fetch additional

            services. Will be nil once all services have been returned.'
          type: string
          x-order: 2
        services:
          description: The list of services
          items:
            $ref: '#/components/schemas/Service'
          type: array
          x-order: 1
      required:
      - services
      type: object
    OidcIssuerRegistrationRequest:
      description: Request body for registering a new OIDC issuer.
      properties:
        jwks:
          $ref: '#/components/schemas/JSONWebKeySet'
          description: The JSON Web Key Set for the OIDC issuer.
          x-order: 5
        maxExpiration:
          description: The maximum token expiration time in seconds.
          format: int64
          type: integer
          x-order: 4
        name:
          description: The display name of the OIDC issuer.
          type: string
          x-order: 1
        thumbprints:
          description: SHA-1 certificate thumbprints used to verify the OIDC issuer's TLS certificate.
          items:
            type: string
          type: array
          x-order: 3
        url:
          description: The URL of the OIDC issuer.
          type: string
          x-order: 2
      required:
      - name
      - url
      type: object
    ListOidcIssuersResponse:
      description: Response containing a list of registered OIDC issuers.
      properties:
        oidcIssuers:
          description: The list of OIDC issuers
          items:
            $ref: '#/components/schemas/OidcIssuerRegistrationResponse'
          type: array
          x-order: 1
      required:
      - oidcIssuers
      type: object
    GetTemplateConfigurationResponse:
      description: Response body for retrieving template configuration details.
      properties:
        destination:
          $ref: '#/components/schemas/TemplateDestination'
          description: The template destination configuration
          x-order: 1
      type: object
    PulumiProjectSettings:
      description: PulumiProjectSettings contains the settings for a Pulumi project, including source and destination paths.
      properties:
        addStacksDisabledReason:
          description: 'An optional reason for disabling new stacks.

            If `CanAddStacks` is false there may be additional context provided

            via this field such that the user can determine why they cannot add

            new stacks. For example, the organization has hit their max stack quota

            or the project''s source and/or destination no longer exist.'
          type: string
          x-order: 4
        canAddStacks:
          description: 'A flag denoting if the user can add stacks to the project.

            This flag might be false if the organization has hit their max stack quota

            or if the project''s source and/or destination no longer exist.'
          type: boolean
          x-order: 3
        destination:
          description: A path to the destination
          type: string
          x-order: 2
        source:
          description: A path to the source of a project
          type: string
          x-order: 1
      required:
      - canAddStacks
      - destination
      - source
      type: object
    UpdateRoleRequest:
      description: Request to update a custom role.
      properties:
        Description:
          description: The new description for the role.
          type: string
          x-order: 2
        Details:
          $ref: '#/components/schemas/PermissionDescriptor'
          description: The permission details for the role.
          x-order: 3
        Name:
          description: The new name for the role.
          type: string
          x-order: 1
      required:
      - Description
      - Details
      - Name
      type: object
    RestoreDeletedStackRequest:
      description: Request to restore a previously deleted stack.
      properties:
        stackName:
          description: The name of the stack to restore.
          type: string
          x-order: 1
      required:
      - stackName
      type: object
    ResourceSearchPagination:
      description: ResourceSearchPagination provides links for paging through results.
      properties:
        cursor:
          description: An opaque cursor for resuming pagination.
          type: string
          x-order: 3
        next:
          description: Link to the next page of results.
          type: string
          x-order: 2
        previous:
          description: Link to the previous page of results.
          type: string
          x-order: 1
      type: object
    ChangeRequestGateEvaluation:
      description: Represents change request gate evaluation.
      properties:
        applicableGates:
          description: Lists all gates that apply to this change request
          items:
            $ref: '#/components/schemas/ChangeGateEvaluation'
          type: array
          x-order: 2
        satisfied:
          description: Indicates if all applicable gates are satisfied and the change request is ready for application
          type: boolean
          x-order: 1
      required:
      - applicableGates
      - satisfied
      type: object
    UpdateChangeRequestRequest:
      description: UpdateChangeRequestRequest is used to update change request metadata.
      properties:
        description:
          description: Updated description/justification for the change request
          type: string
          x-order: 1
      required:
      - description
      type: object
    PkixAttributeTypeAndValue:
      description: PkixAttributeTypeAndValue represents an ASN.1 attribute type and value pair.
      properties:
        Type:
          description: The ASN.1 object identifier of the attribute type.
          type: string
          x-order: 1
        Value:
          description: The value of the attribute.
          type: object
          x-order: 2
      required:
      - Type
      - Value
      type: object
    DisableCustomerManagedKeyRequest:
      description: DisableCustomerManagedKeyRequest is the request body for disabling a customer-managed encryption key.
      properties:
        destID:
          description: The destination identifier for the customer-managed key to disable.
          type: string
          x-order: 1
      required:
      - destID
      type: object
    AppProjectTemplateConfigValue:
      description: ProjectTemplateConfigValue is a config value included in the project template manifest.
      properties:
        default:
          description: Default is an optional default value for the config value.
          type: string
          x-order: 2
        description:
          description: Description is an optional description for the config value.
          type: string
          x-order: 1
        secret:
          description: Secret may be set to true to indicate that the config value should be encrypted.
          type: boolean
          x-order: 3
      type: object
    CreateGitHubTeamRequest:
      description: CreateGitHubTeamRequest is the request to create a new Pulumi Team backed by a GitHub team.
      properties:
        githubTeamID:
          description: 'GitHubTeamID is the GitHub ID of the team to mirror.

            Must be in the same GitHub organization that the Pulumi org is backed by.'
          format: int64
          type: integer
          x-order: 1
      required:
      - githubTeamID
      type: object
    AuthPolicy:
      description: Represents auth policy.
      properties:
        created:
          description: The creation timestamp
          type: string
          x-order: 3
        id:
          description: The unique identifier
          type: string
          x-order: 1
        modified:
          description: The last modification timestamp
          type: string
          x-order: 4
        policies:
          description: List of policies
          items:
            $ref: '#/components/schemas/AuthPolicyDefinition'
          type: array
          x-order: 5
        version:
          description: The version number
          format: int64
          type: integer
          x-order: 2
      required:
      - id
      - policies
      - version
      type: object
    WebhookDelivery:
      description: 'WebhookDelivery is a result of a webhook that was sent. i.e. the Pulumi-side logs

        for the end-users webhook. It merges both model.WebhookEvent and model.WebhookDelivery.'
      properties:
        duration:
          description: The duration of the delivery request in milliseconds.
          format: int64
          type: integer
          x-order: 5
        id:
          description: The unique identifier of the delivery.
          type: string
          x-order: 1
        kind:
          description: The kind of webhook event.
          type: string
          x-order: 2
        payload:
          description: The JSON payload that was sent.
          type: string
          x-order: 3
        requestHeaders:
          description: The HTTP headers sent with the request.
          type: string
          x-order: 7
        requestUrl:
          description: The URL the webhook was delivered to.
          type: string
          x-order: 6
        responseBody:
          description: The HTTP response body.
          type: string
          x-order: 10
        responseCode:
          description: The HTTP response status code.
          format: int64
          type: integer
          x-order: 8
        responseHeaders:
          description: The HTTP response headers.
          type: string
          x-order: 9
        timestamp:
          description: The time the delivery was sent, as a Unix epoch timestamp.
          format: int64
          type: integer
          x-order: 4
      required:
      - duration
      - id
      - kind
      - payload
      - requestHeaders
      - requestUrl
      - responseBody
      - responseCode
      - responseHeaders
      - timestamp
      type: object
    PolicyViolationV2:
      description: PolicyViolationV2 represents a policy violation detected during an update or resource scan.
      properties:
        accountName:
          description: The Insights account name associated with the violation, for resource-scoped violations.
          type: string
          x-order: 5
        id:
          description: The unique identifier of the policy violation.
          type: string
          x-order: 1
        kind:
          description: The kind of policy violation (audit or preventative).
          enum:
          - audit
          - preventative
          type: string
          x-order: 16
          x-pulumi-model-property:
            enumTypeName: PolicyIssueKind
            enumComments: Whether a policy issue is audit-only or preventative. Audit issues are informational; preventative issues block operations.
        level:
          description: The enforcement level of the violated policy (e.g. advisory, mandatory, disabled).
          type: string
          x-order: 15
        message:
          description: A human-readable message describing the policy violation.
          type: string
          x-order: 13
        observedAt:
          description: The timestamp when the violation was observed.
          format: date-time
          type: string
          x-order: 14
        policyName:
          description: The name of the policy that was violated.
          type: string
          x-order: 9
        policyPack:
          description: The name of the policy pack that produced this violation.
          type: string
          x-order: 7
        policyPackTag:
          description: The tag of the policy pack version that produced this violation.
          type: string
          x-order: 8
        projectName:
          description: The name of the project containing the violating resource.
          type: string
          x-order: 2
        resourceName:
          description: The name of the resource that violated the policy.
          type: string
          x-order: 12
        resourceType:
          description: The type of the resource that violated the policy.
          type: string
          x-order: 11
        resourceURN:
          description: The URN of the resource that violated the policy.
          type: string
          x-order: 10
        resourceVersion:
          description: The resource version where the violation was detected.
          format: int64
          type: integer
          x-order: 6
        stackName:
          description: The name of the stack containing the violating resource.
          type: string
          x-order: 3
        stackVersion:
          description: The stack version where the violation was detected.
          format: int64
          type: integer
          x-order: 4
      required:
      - id
      - kind
      - level
      - message
      - observedAt
      - policyName
      - policyPack
      - policyPackTag
      - projectName
      - resourceName
      - resourceType
      - resourceURN
      type: object
    CreateOrgAccessTokenRequest:
      allOf:
      - $ref: '#/components/schemas/BaseCreateAccessTokenRequest'
      - description: CreateOrgAccessTokenRequest is the accepted request body for creating an organization access token.
        properties:
          admin:
            description: Whether the entity has admin privileges
            type: boolean
            x-order: 2
          name:
            description: The name
            type: string
            x-order: 1
          roleID:
            description: The role identifier
            type: string
            x-order: 3
        required:
        - admin
        - name
        type: object
    PulumiTemplateRemote:
      allOf:
      - $ref: '#/components/schemas/WorkspaceProjectTemplate'
      - description: A pulumi template remote where the source URL contains a valid Pulumi.yaml file.
        properties:
          name:
            description: The name of the template
            type: string
            x-order: 1
          repoSlug:
            description: The template repository slug
            type: string
            x-order: 6
          runtime:
            description: The runtime of the template
            type: string
            x-order: 4
          sourceName:
            description: The name of the template source - for display purposes
            type: string
            x-order: 2
          sourceURL:
            description: The unique url that identifies the template to the service
            type: string
            x-order: 3
          vendor:
            description: The vendor hosting the templates
            type: string
            x-order: 5
        required:
        - name
        - repoSlug
        - runtime
        - sourceName
        - sourceURL
        - vendor
        type: object
    AppStackConfig:
      description: StackConfig describes the configuration of a stack from Pulumi Cloud.
      properties:
        encryptedKey:
          description: The KMS-encrypted ciphertext for the data key used for secrets encryption. Only used for cloud-based secrets providers.
          type: string
          x-order: 3
        encryptionSalt:
          description: The stack's base64-encoded encryption salt. Only used for passphrase-based secrets providers.
          type: string
          x-order: 4
        environment:
          description: Reference to ESC environment to use as stack configuration.
          type: string
          x-order: 1
        secretsProvider:
          description: The stack's secrets provider.
          type: string
          x-order: 2
      required:
      - environment
      type: object
    NewPolicyGroupRequest:
      description: NewPolicyGroupRequest is the request struct to create a new Policy Group.
      properties:
        agentPoolId:
          description: Agent pool ID for policy evaluation. Defaults to Pulumi hosted pool if not specified.
          type: string
          x-order: 4
        entityType:
          description: The type of entities this policy group applies to (stacks or accounts).
          enum:
          - stacks
          - accounts
          type: string
          x-order: 2
          x-pulumi-model-property:
            enumTypeName: PolicyGroupEntityType
            enumComments: PolicyGroupEntityType represents the type of entities a policy group applies to
        mode:
          description: The enforcement mode for the policy group (audit or preventative). Defaults to 'audit' for account policy groups, 'preventative' for stack policy groups.
          enum:
          - audit
          - preventative
          type: string
          x-order: 3
          x-pulumi-model-property:
            enumTypeName: PolicyGroupMode
            enumComments: PolicyGroupMode represents the enforcement mode for a policy group
        name:
          description: The name of the new policy group.
          type: string
          x-order: 1
      required:
      - entityType
      - name
      type: object
    WebhookResponse:
      allOf:
      - $ref: '#/components/schemas/Webhook'
      - description: WebhookResponse extends Webhook with additional response-only fields.
        properties:
          hasSecret:
            description: 'HasSecret is true if the webhook has a secret. This is used to determine whether

              to show that there is a secret in the UI.'
            type: boolean
            x-order: 1
          secretCiphertext:
            description: 'SecretCiphertext is the ciphertext value of the webhook''s secret.

              It''s used to check whether the secret was changed by the PSP'
            type: string
            x-order: 2
        required:
        - hasSecret
        - secretCiphertext
        type: object
    StackUpdate:
      description: StackUpdate contains information about a stack update.
      properties:
        time:
          description: The timestamp when the update was created.
          type: string
          x-order: 1
        version:
          description: The version number of the update.
          format: int32
          type: integer
          x-order: 2
      required:
      - time
      - version
      type: object
    AppDecryptValueResponse:
      description: DecryptValueResponse defines the response body for a decrypted value.
      properties:
        plaintext:
          description: The decrypted value.
          items:
            format: byte
            type: string
          type: array
          x-order: 1
      required:
      - plaintext
      type: object
    ChangeGateTargetOutput:
      description: Output representation of change gate target - contains full details for API responses
      properties:
        actionTypes:
          description: The action types this gate targets
          items:
            enum:
            - update
            - open
            type: string
            x-pulumi-model-property:
              enumTypeName: ChangeGateTargetActionType
              enumComments: ChangeGateTargetActionType represents the type of action a gate governs
          type: array
          x-order: 3
        entityInfo:
          $ref: '#/components/schemas/TargetEntity'
          description: Populated details about the target entity
          x-order: 4
        entityType:
          description: The entity type this gate targets
          enum:
          - environment
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: ChangeGateTargetEntityType
            enumComments: Represents change gate target entity type.
        qualifiedName:
          description: The qualified name of the entity this gate targets (e.g., 'project/env')
          type: string
          x-order: 2
      required:
      - actionTypes
      - entityType
      type: object
    AppGetPolicyPackResponse:
      description: GetPolicyPackResponse is the response to get a specific Policy Pack's metadata and policies.
      properties:
        applied:
          description: Whether this policy pack version is currently applied to any policy group.
          type: boolean
          x-order: 6
        displayName:
          description: Human-readable display name of the policy pack.
          type: string
          x-order: 2
        name:
          description: The unique name of the policy pack.
          type: string
          x-order: 1
        policies:
          description: The individual policies contained in this policy pack.
          items:
            $ref: '#/components/schemas/AppPolicy'
          type: array
          x-order: 5
        version:
          description: Numeric version of the policy pack, auto-incremented on each publish.
          format: int64
          type: integer
          x-order: 3
        versionTag:
          description: Semantic version tag for this policy pack version (e.g. '1.2.0').
          type: string
          x-order: 4
      required:
      - applied
      - displayName
      - name
      - policies
      - version
      - versionTag
      type: object
    CloseChangeRequestRequest:
      description: CloseChangeRequestRequest is used to close a change request without applying it
      properties:
        comment:
          description: Optional comment explaining why the change request is being closed
          type: string
          x-order: 1
      type: object
    UnapproveChangeRequestRequest:
      description: UnapproveChangeRequestRequest is used to withdraw approval from a change request or specific revision
      properties:
        comment:
          description: Optional note clarifying the reason for revoking approval
          type: string
          x-order: 1
      type: object
    GetOrgTemplateSourcesResponse:
      description: Response body for retrieving template sources configured for an organization.
      properties:
        sources:
          description: The list of template sources
          items:
            $ref: '#/components/schemas/TemplateSource'
          type: array
          x-order: 1
      required:
      - sources
      type: object
    GetRegistryPolicyPackVersionResponse:
      description: 'GetRegistryPolicyPackVersionResponse contains detailed information about a specific

        version of a policy pack, optionally including the actual policy definitions.'
      properties:
        policies:
          description: 'Policies contains the individual policy definitions in this version.

            Each policy includes its configuration schema and enforcement rules.

            This field is optional and may be omitted for lightweight responses that only provide registry metadata.'
          items:
            $ref: '#/components/schemas/AppPolicy'
          type: array
          x-order: 2
        policyPack:
          $ref: '#/components/schemas/RegistryPolicyPack'
          description: PolicyPack contains the metadata for this specific version.
          x-order: 1
      required:
      - policyPack
      type: object
    PackageUsageResponse:
      description: PackageUsageResponse contains information about which stacks use a specific package.
      properties:
        continuationToken:
          description: Token for fetching the next page of results. Null if there are no more results.
          type: string
          x-order: 4
        packageName:
          description: The package name that was queried.
          type: string
          x-order: 1
        stacks:
          description: The list of stacks using this package.
          items:
            $ref: '#/components/schemas/StackUsage'
          type: array
          x-order: 3
        totalStacks:
          description: The total number of stacks using this package.
          format: int32
          type: integer
          x-order: 2
      type: object
    AddOrganizationMemberRequest:
      description: AddOrganizationMemberRequest is the request type for adding a new member to an organization.
      properties:
        role:
          description: The built-in role assigned to the new member. Must be `member`, `admin`, or `billingManager`.
          enum:
          - none
          - member
          - admin
          - potential-member
          - stack-collaborator
          - billing-manager
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: OrganizationRole
            enumComments: OrganizationRole is an enum defining a member's role within an organization.
            enumFieldNames:
            - None
            - Member
            - Admin
            - PotentialMember
            - StackCollaborator
            - BillingManager
            enumFieldComments:
            - OrganizationRoleNone describes the role of non-members.
            - OrganizationRoleMember is the role for regular members.
            - OrganizationRoleAdmin is the role for admins.
            - 'OrganizationRolePotentialMember is the role for users who are explicitly

              not a member of the organization, but are a member of the backing org on

              the 3rd party identity provider. (i.e. they could join the org.)'
            - 'OrganizationRoleStackCollaborator is the role for users who are not a member

              of an organization, but have been explicitly granted access to some of the

              organization''s stacks. So they have limited permissions to access the org''s

              data.'
            - OrganizationRoleBillingManager is the role for billing admins.
      required:
      - role
      type: object
    AddServiceItem:
      description: A simple struct representing the metadata needed to add an item via user-facing information.
      properties:
        name:
          description: the name (including any namespacing) of the item
          type: string
          x-order: 2
        type:
          description: the type of the item to add
          type: string
          x-order: 1
      required:
      - name
      - type
      type: object
    PkixName:
      description: PkixName represents an X.509 distinguished name (DN).
      properties:
        CommonName:
          description: The common name (CN) of the distinguished name.
          type: string
          x-order: 9
        Country:
          description: The country names in the distinguished name.
          items:
            type: string
          type: array
          x-order: 1
        ExtraNames:
          description: Additional attribute type and value pairs to include in the distinguished name.
          items:
            $ref: '#/components/schemas/PkixAttributeTypeAndValue'
          type: array
          x-order: 11
        Locality:
          description: The locality (city) names in the distinguished name.
          items:
            type: string
          type: array
          x-order: 4
        Names:
          description: The parsed attribute type and value pairs of the distinguished name.
          items:
            $ref: '#/components/schemas/PkixAttributeTypeAndValue'
          type: array
          x-order: 10
        Organization:
          description: The organization names in the distinguished name.
          items:
            type: string
          type: array
          x-order: 2
        OrganizationalUnit:
          description: The organizational unit names in the distinguished name.
          items:
            type: string
          type: array
          x-order: 3
        PostalCode:
          description: The postal codes in the distinguished name.
          items:
            type: string
          type: array
          x-order: 7
        Province:
          description: The state or province names in the distinguished name.
          items:
            type: string
          type: array
          x-order: 5
        SerialNumber:
          description: The serial number of the distinguished name.
          type: string
          x-order: 8
        StreetAddress:
          description: The street addresses in the distinguished name.
          items:
            type: string
          type: array
          x-order: 6
      required:
      - CommonName
      - Country
      - ExtraNames
      - Locality
      - Names
      - Organization
      - OrganizationalUnit
      - PostalCode
      - Province
      - SerialNumber
      - StreetAddress
      type: object
    AuditLogsExportS3Config:
      description: AuditLogsExportS3Config describes how a Pulumi organization's audit log data can be exported to S3.
      properties:
        iamRoleArn:
          description: ARN of the IAM role that Pulumi will assume to write to the S3 bucket.
          type: string
          x-order: 3
        s3BucketName:
          description: Name of the S3 bucket to export audit logs to.
          type: string
          x-order: 1
        s3PathPrefix:
          description: Optional path prefix within the S3 bucket for exported log files.
          type: string
          x-order: 2
      required:
      - iamRoleArn
      - s3BucketName
      type: object
    KeyEncryptionKeyMigration:
      description: Status of a key encryption key migration.
      properties:
        id:
          description: The migration identifier
          type: string
          x-order: 1
        state:
          description: The current state of the migration
          type: string
          x-order: 2
      required:
      - id
      - state
      type: object
    ChangeGateEvaluation:
      description: ChangeGateEvaluation contains the evaluation status of a single change gate
      properties:
        id:
          description: The unique identifier of the gate
          type: string
          x-order: 1
        name:
          description: The human-readable name of the gate
          type: string
          x-order: 2
        ruleDetails:
          $ref: '#/components/schemas/ChangeGateRuleEvaluation'
          description: Rule-type-specific evaluation details
          x-order: 4
        satisfied:
          description: Indicates whether this gate's requirements have been met
          type: boolean
          x-order: 3
      required:
      - id
      - name
      - ruleDetails
      - satisfied
      type: object
    ListChangeRequestsResponse:
      description: Response containing a paginated list of change requests.
      properties:
        changeRequests:
          description: The list of change requests
          items:
            $ref: '#/components/schemas/ChangeRequest'
          type: array
          x-order: 1
        continuationToken:
          description: Continuation token for pagination. If null, there are no more results available.
          type: string
          x-order: 2
      required:
      - changeRequests
      - continuationToken
      type: object
    WorkspaceProjectTemplate:
      description: WorkspaceProjectTemplate describes a Pulumi project template from the workspace.
      properties:
        config:
          additionalProperties:
            $ref: '#/components/schemas/AppProjectTemplateConfigValue'
          description: Config is an optional template config.
          type: object
          x-order: 4
        description:
          description: Description is an optional description of the template.
          type: string
          x-order: 2
        displayName:
          description: DisplayName is an optional user friendly name of the template.
          type: string
          x-order: 1
        important:
          description: 'Indicates the template is important. Deprecated: this field is no longer used.'
          type: boolean
          x-order: 5
        metadata:
          additionalProperties:
            type: string
          description: Metadata are key/value pairs used to attach additional metadata to a template.
          type: object
          x-order: 6
        quickstart:
          description: Quickstart contains optional text to be displayed after template creation.
          type: string
          x-order: 3
      type: object
    AuditLogEvent:
      description: AuditLogEvent represents an AuditLogEvent. It also contains the user who invoked it.
      properties:
        actorName:
          description: Display name of the non-human actor (e.g. deploy token name) that triggered the event.
          type: string
          x-order: 11
        actorUrn:
          description: Pulumi URN of the non-human actor that triggered the event.
          type: string
          x-order: 12
        authFailure:
          description: Whether this event represents a failed authentication attempt.
          type: boolean
          x-order: 10
        description:
          description: Human-readable description of the event.
          type: string
          x-order: 4
        event:
          description: The audit event type identifier (e.g. 'stack.update', 'member.added').
          type: string
          x-order: 3
        reqOrgAdmin:
          description: Whether the action that triggered this event required the organization ADMIN role.
          type: boolean
          x-order: 8
        reqStackAdmin:
          description: Whether the action required stack admin privileges.
          type: boolean
          x-order: 9
        sourceIP:
          description: IP address of the client that triggered the event.
          type: string
          x-order: 2
        timestamp:
          description: Unix epoch timestamp (seconds) when the event occurred.
          format: int64
          type: integer
          x-order: 1
        tokenID:
          description: ID of the access token used to authenticate, if applicable.
          type: string
          x-order: 6
        tokenName:
          description: Name of the access token used to authenticate, if applicable.
          type: string
          x-order: 7
        user:
          $ref: '#/components/schemas/UserInfo'
          description: The user who performed the action.
          x-order: 5
      required:
      - description
      - event
      - sourceIP
      - timestamp
      - user
      type: object
    CustomerManagedKeyInput:
      description: Represents customer managed key input.
      properties:
        awsKms:
          $ref: '#/components/schemas/AwsKmsConfig'
          description: The aws kms
          x-order: 3
        keyType:
          description: The key type
          enum:
          - aws_kms
          - service
          type: string
          x-order: 2
          x-pulumi-model-property:
            enumTypeName: KeyType
            enumComments: 'The type of encryption key used for secrets management. Valid values: ''aws_kms'' (AWS KMS), ''service'' (Pulumi-managed).'
            enumFieldNames:
            - AwsKms
            - Service
        name:
          description: The name
          type: string
          x-order: 1
      required:
      - keyType
      - name
      type: object
    ChangeRequest:
      description: Request body for change.
      properties:
        action:
          description: The type of action this change request will perform
          enum:
          - update
          - open
          type: string
          x-order: 8
          x-pulumi-model-property:
            enumTypeName: ChangeGateTargetActionType
            enumComments: ChangeGateTargetActionType represents the type of action a gate governs
        createdAt:
          description: When this change request was created
          format: date-time
          type: string
          x-order: 6
        createdBy:
          $ref: '#/components/schemas/UserInfo'
          description: The user who created this change request
          x-order: 4
        description:
          description: The description/justification for this change request
          type: string
          x-order: 5
        entity:
          $ref: '#/components/schemas/TargetEntity'
          description: The entity this change request targets
          x-order: 7
        id:
          description: The change request ID
          type: string
          x-order: 1
        latestRevisionNumber:
          description: The current revision number
          format: int64
          type: integer
          x-order: 9
        orgID:
          description: The organization ID
          type: string
          x-order: 3
        status:
          description: The current status of the change request
          type: string
          x-order: 2
      required:
      - action
      - createdAt
      - createdBy
      - description
      - entity
      - id
      - latestRevisionNumber
      - orgID
      - status
      type: object
    AppPulumiStackReference:
      description: PulumiStackReference contains the StackName and ProjectName of the stack.
      properties:
        name:
          description: The name
          type: string
          x-order: 1
        routingProject:
          description: The routing project
          type: string
          x-order: 2
      required:
      - name
      - routingProject
      type: object
    BaseCreateAccessTokenRequest:
      description: Request body for base create access token.
      properties:
        description:
          description: The description
          type: string
          x-order: 1
        expires:
          description: The expiration time
          format: int64
          type: integer
          x-order: 2
      required:
      - description
      - expires
      type: object
    Team:
      description: 'Team describes a Pulumi team. A Pulumi team may have its organization

        managed by another service, such as GitHub.'
      properties:
        accounts:
          description: The list of account permissions granted to the team.
          items:
            $ref: '#/components/schemas/TeamAccountPermission'
          type: array
          x-order: 8
        description:
          description: A free-form text description of the team's purpose.
          type: string
          x-order: 4
        displayName:
          description: The human-readable display name shown in the UI.
          type: string
          x-order: 3
        environments:
          description: The list of environment settings for the team.
          items:
            $ref: '#/components/schemas/TeamEnvironmentSettings'
          type: array
          x-order: 7
        kind:
          description: The kind of team (e.g., pulumi or GitHub-backed).
          enum:
          - github
          - pulumi
          - scim
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: TeamKind
            enumComments: TeamKind is the kind of team.
            enumFieldNames:
            - GitHub
            - Pulumi
            - SCIM
            enumFieldComments:
            - TeamKindGitHub is for teams where membership is managed by GitHub.
            - TeamKindPulumi is for teams where membership is managed by Pulumi.
            - TeamKindSCIM is for SCIM provisioned teams. Membership is managed by its IdP.
        listMembersError:
          description: 'ListMembersError is the error message if an error was encountered whilst trying to

            contact the team''s backend (eg. GitHub). The UI will only show this error if it is non-nil

            and if Members itself is an empty slice.'
          type: string
          x-order: 9
        members:
          description: The list of team members.
          items:
            $ref: '#/components/schemas/TeamMemberInfo'
          type: array
          x-order: 5
        name:
          description: The unique identifier name of the team within the organization.
          type: string
          x-order: 2
        roleIds:
          description: 'RoleIDs are the IDs of the FGA roles assigned to the team, if any.

            Currently only one role per team is supported.'
          items:
            type: string
          type: array
          x-order: 11
        stacks:
          description: The list of stack permissions granted to the team.
          items:
            $ref: '#/components/schemas/TeamStackPermission'
          type: array
          x-order: 6
        userRole:
          description: UserRole is the calling user's role on the given team.
          enum:
          - none
          - member
          - admin
          type: string
          x-order: 10
          x-pulumi-model-property:
            enumTypeName: TeamRole
            enumComments: TeamRole is the kind of role a user has in a team.
      required:
      - description
      - displayName
      - kind
      - name
      type: object
    AddServiceItemsRequest:
      description: Request for adding items to an existing service.
      properties:
        items:
          description: List of items
          items:
            $ref: '#/components/schemas/AddServiceItem'
          type: array
          x-order: 1
      required:
      - items
      type: object
    GetNaturalLanguageQueryResponse:
      description: Response body for a natural language query translation.
      properties:
        query:
          description: The translated query string
          type: string
          x-order: 1
      required:
      - query
      type: object
    PermissionDescriptorBase:
      description: PermissionDescriptorBase defines the base fields for a permission descriptor.
      properties:
        description:
          description: A human-readable description of the permission descriptor.
          type: string
          x-order: 2
        details:
          $ref: '#/components/schemas/PermissionDescriptor'
          description: The detailed permission descriptor tree.
          x-order: 5
        name:
          description: The name of the permission descriptor.
          type: string
          x-order: 1
        resourceType:
          description: The resource type this permission descriptor applies to.
          type: string
          x-order: 3
        uxPurpose:
          description: The UX purpose of this permission descriptor (e.g. role, policy, set).
          enum:
          - role
          - role_private
          - role_temporary
          - policy
          - set
          type: string
          x-order: 4
          x-pulumi-model-property:
            enumTypeName: PermissionDescriptorUXPurpose
            enumComments: 'Categorizes how a permission descriptor is presented in the UI. Valid values: role, role_private, policy, set.'
            enumFieldNames:
            - Role
            - RolePrivate
            - RoleTemporary
            - Policy
            - Set
      type: object
    PolicyIssue:
      description: PolicyIssue represents a policy violation or issue detected during policy evaluation.
      properties:
        assignedTo:
          $ref: '#/components/schemas/UserInfo'
          description: The user the policy issue is assigned to.
          x-order: 22
        entityId:
          description: The identifier of the entity this issue applies to.
          type: string
          x-order: 4
        entityProject:
          description: The project name (for stack entities) or parent Insights account name (for resource entities).
          type: string
          x-order: 3
        entityType:
          description: The type of entity this issue applies to.
          enum:
          - stack
          - insights-account
          type: string
          x-order: 2
          x-pulumi-model-property:
            enumTypeName: IssueEntityType
            enumComments: 'The type of entity associated with a policy issue. Valid values: ''stack'', ''insights-account''.'
            enumFieldNames:
            - Stack
            - InsightsAccount
        id:
          description: The unique identifier of the policy issue.
          type: string
          x-order: 1
        kind:
          description: The kind of policy issue (audit or preventative).
          enum:
          - audit
          - preventative
          type: string
          x-order: 20
          x-pulumi-model-property:
            enumTypeName: PolicyIssueKind
            enumComments: Whether a policy issue is audit-only or preventative. Audit issues are informational; preventative issues block operations.
        lastModified:
          description: The timestamp when the issue was last modified.
          format: date-time
          type: string
          x-order: 16
        level:
          description: The enforcement level of the policy (e.g. advisory, mandatory, disabled).
          type: string
          x-order: 17
        message:
          description: A human-readable message describing the policy violation.
          type: string
          x-order: 14
        observedAt:
          description: The timestamp when the issue was first observed.
          format: date-time
          type: string
          x-order: 15
        policyGroupName:
          description: The name of the policy group this issue belongs to.
          type: string
          x-order: 23
        policyGroupType:
          description: The type of the policy group this issue belongs to.
          enum:
          - audit
          - preventative
          type: string
          x-order: 24
          x-pulumi-model-property:
            enumTypeName: PolicyGroupMode
            enumComments: PolicyGroupMode represents the enforcement mode for a policy group
        policyName:
          description: The name of the policy that was violated.
          type: string
          x-order: 9
        policyPack:
          description: The name of the policy pack that produced this issue.
          type: string
          x-order: 7
        policyPackTag:
          description: The tag of the policy pack version that produced this issue.
          type: string
          x-order: 8
        priority:
          description: The priority level of the policy issue.
          enum:
          - p0
          - p1
          - p2
          - p3
          - p4
          type: string
          x-order: 21
          x-pulumi-model-property:
            enumTypeName: PolicyIssuePriority
            enumComments: Priority level of a policy issue, from P0 (most critical) to P4 (least critical).
        resourceName:
          description: The name of the resource that violated the policy.
          type: string
          x-order: 13
        resourceProvider:
          description: The provider of the resource that violated the policy.
          type: string
          x-order: 11
        resourceType:
          description: The type of the resource that violated the policy.
          type: string
          x-order: 12
        resourceURN:
          description: The URN of the resource that violated the policy.
          type: string
          x-order: 10
        resourceVersion:
          description: The resource version where the issue was detected.
          format: int64
          type: integer
          x-order: 6
        severity:
          description: The severity of the policy violation.
          enum:
          - ''
          - low
          - medium
          - high
          - critical
          type: string
          x-order: 18
          x-pulumi-model-property:
            enumTypeName: AppPolicySeverity
            enumComments: Indicates the severity of a policy.
            enumFieldNames:
            - Unspecified
            - Low
            - Medium
            - High
            - Critical
        stackVersion:
          description: The stack version where the issue was detected.
          format: int64
          type: integer
          x-order: 5
        status:
          description: The current status of the policy issue.
          enum:
          - open
          - in_progress
          - by_design
          - fixed
          - ignored
          type: string
          x-order: 19
          x-pulumi-model-property:
            enumTypeName: PolicyIssueStatus
            enumComments: 'Lifecycle status of a policy issue. Valid values: open, in_progress, by_design, fixed, ignored. Note: fixed is a read-only status set automatically when an issue is resolved; it cannot be manually set via the API.'
            enumFieldNames:
            - Open
            - InProgress
            - ByDesign
            - Fixed
            - Ignored
      required:
      - entityId
      - entityProject
      - entityType
      - id
      - kind
      - level
      - observedAt
      - policyName
      - policyPack
      - policyPackTag
      - priority
      - resourceName
      - resourceProvider
      - resourceType
      - resourceURN
      - severity
      - status
      type: object
    ChangeRequestEvent:
      description: ChangeRequestEvent represents an entry in the change request's activity log
      discriminator:
        mapping:
          approved_by_user: '#/components/schemas/ChangeRequestApprovedEvent'
          commented: '#/components/schemas/ChangeRequestCommentedEvent'
          description_updated: '#/components/schemas/ChangeRequestDescriptionUpdatedEvent'
          revision_added: '#/components/schemas/ChangeRequestRevisionAddedEvent'
          status_changed: '#/components/schemas/ChangeRequestStatusChangedEvent'
          unapproved_by_user: '#/components/schemas/ChangeRequestUnapprovedEvent'
        propertyName: eventType
      properties:
        changeRequestId:
          description: The change request this event belongs to
          type: string
          x-order: 3
        comment:
          description: Optional comment associated with this event
          type: string
          x-order: 7
        createdAt:
          description: When this event occurred
          format: date-time
          type: string
          x-order: 6
        createdBy:
          $ref: '#/components/schemas/UserInfo'
          description: The user who triggered this event
          x-order: 5
        eventType:
          type: string
        id:
          description: The event ID
          type: string
          x-order: 1
        replacedBy:
          description: ID of event that replaces this one (for event updates)
          type: string
          x-order: 2
        revisionNumber:
          description: The revision number that was latest when this event occurred
          format: int64
          type: integer
          x-order: 4
      required:
      - changeRequestId
      - createdAt
      - createdBy
      - id
      - revisionNumber
      - eventType
      type: object
    ListDeletedStacksResponse:
      description: Response containing a list of deleted stacks.
      properties:
        deletedStacks:
          description: The list of deleted stacks
          items:
            $ref: '#/components/schemas/DeletedStack'
          type: array
          x-order: 1
      required:
      - deletedStacks
      type: object
    GetPolicyComplianceResultsRequest:
      description: Request for policy compliance results
      properties:
        continuationToken:
          description: Continuation token for pagination
          type: string
          x-order: 2
        entity:
          description: Entity type to filter by
          enum:
          - stack
          - account
          - severity
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: PolicyComplianceEntityType
            enumComments: PolicyComplianceEntityType defines the types of entities for policy compliance results.
            enumFieldComments:
            - Stack entity type for policy compliance results
            - Account entity type for policy compliance results
            - Severity heat map for policy compliance results
        size:
          description: Number of results to return
          format: int64
          type: integer
          x-order: 3
      required:
      - entity
      type: object
    ListChangeRequestEventsResponse:
      description: Response containing a paginated list of change request events.
      properties:
        continuationToken:
          description: Continuation token for pagination. If null, there are no more results available.
          type: string
          x-order: 2
        events:
          description: The list of events for this page.
          items:
            $ref: '#/components/schemas/ChangeRequestEvent'
          type: array
          x-order: 1
      required:
      - continuationToken
      - events
      type: object
    ChangeGateRuleInput:
      description: Input specification for change gate rule - contains minimal identifiers for API requests
      discriminator:
        mapping:
          approval_required: '#/components/schemas/ChangeGateApprovalRuleInput'
        propertyName: ruleType
      properties:
        ruleType:
          type: string
      required:
      - ruleType
      type: object
    X509Certificate:
      description: X509Certificate represents an X.509 certificate.
      properties:
        AuthorityKeyId:
          description: The authority key identifier extension value.
          items:
            format: byte
            type: string
          type: array
          x-order: 27
        BasicConstraintsValid:
          description: Whether the basic constraints extension is valid.
          type: boolean
          x-order: 22
        CRLDistributionPoints:
          description: CRL distribution point URLs.
          items:
            type: string
          type: array
          x-order: 43
        DNSNames:
          description: DNS names from the subject alternative name extension.
          items:
            type: string
          type: array
          x-order: 30
        EmailAddresses:
          description: Email addresses from the subject alternative name extension.
          items:
            type: string
          type: array
          x-order: 31
        ExcludedDNSDomains:
          description: Excluded DNS domain names from the name constraints extension.
          items:
            type: string
          type: array
          x-order: 36
        ExcludedEmailAddresses:
          description: Excluded email addresses from the name constraints extension.
          items:
            type: string
          type: array
          x-order: 40
        ExcludedIPRanges:
          description: Excluded IP ranges from the name constraints extension.
          items:
            $ref: '#/components/schemas/NetIPNet'
          type: array
          x-order: 38
        ExcludedURIDomains:
          description: Excluded URI domains from the name constraints extension.
          items:
            type: string
          type: array
          x-order: 42
        ExtKeyUsage:
          description: Extended key usage values.
          items:
            format: int64
            type: integer
          type: array
          x-order: 20
        Extensions:
          description: The certificate extensions.
          items:
            $ref: '#/components/schemas/PkixExtension'
          type: array
          x-order: 17
        ExtraExtensions:
          description: Additional extensions to add to the certificate.
          items:
            $ref: '#/components/schemas/PkixExtension'
          type: array
          x-order: 18
        IPAddresses:
          description: IP addresses from the subject alternative name extension.
          items:
            items:
              format: byte
              type: string
            type: array
          type: array
          x-order: 32
        InhibitAnyPolicy:
          description: The inhibit any-policy constraint value.
          format: int64
          type: integer
          x-order: 46
        InhibitAnyPolicyZero:
          description: Whether InhibitAnyPolicy was explicitly set to zero.
          type: boolean
          x-order: 47
        InhibitPolicyMapping:
          description: The inhibit policy mapping constraint value.
          format: int64
          type: integer
          x-order: 48
        InhibitPolicyMappingZero:
          description: Whether InhibitPolicyMapping was explicitly set to zero.
          type: boolean
          x-order: 49
        IsCA:
          description: Whether the certificate is a CA certificate.
          type: boolean
          x-order: 23
        Issuer:
          $ref: '#/components/schemas/PkixName'
          description: The certificate issuer distinguished name.
          x-order: 12
        IssuingCertificateURL:
          description: Issuing certificate URLs from the authority information access extension.
          items:
            type: string
          type: array
          x-order: 29
        KeyUsage:
          description: Bitfield of key usage flags.
          format: int64
          type: integer
          x-order: 16
        MaxPathLen:
          description: Maximum number of intermediate CAs allowed in the path.
          format: int64
          type: integer
          x-order: 24
        MaxPathLenZero:
          description: Whether MaxPathLen was explicitly set to zero.
          type: boolean
          x-order: 25
        NotAfter:
          description: The end of the certificate validity period.
          format: date-time
          type: string
          x-order: 15
        NotBefore:
          description: The start of the certificate validity period.
          format: date-time
          type: string
          x-order: 14
        OCSPServer:
          description: OCSP server URLs from the authority information access extension.
          items:
            type: string
          type: array
          x-order: 28
        PermittedDNSDomains:
          description: Permitted DNS domain names from the name constraints extension.
          items:
            type: string
          type: array
          x-order: 35
        PermittedDNSDomainsCritical:
          description: Whether the name constraints are marked critical.
          type: boolean
          x-order: 34
        PermittedEmailAddresses:
          description: Permitted email addresses from the name constraints extension.
          items:
            type: string
          type: array
          x-order: 39
        PermittedIPRanges:
          description: Permitted IP ranges from the name constraints extension.
          items:
            $ref: '#/components/schemas/NetIPNet'
          type: array
          x-order: 37
        PermittedURIDomains:
          description: Permitted URI domains from the name constraints extension.
          items:
            type: string
          type: array
          x-order: 41
        Policies:
          description: Certificate policies.
          items:
            type: string
          type: array
          x-order: 45
        PolicyIdentifiers:
          description: Certificate policy OIDs.
          items:
            type: string
          type: array
          x-order: 44
        PolicyMappings:
          description: Policy mappings from the policy mapping extension.
          items:
            $ref: '#/components/schemas/X509PolicyMapping'
          type: array
          x-order: 52
        PublicKey:
          description: The public key contained in the certificate.
          type: object
          x-order: 9
        PublicKeyAlgorithm:
          description: The public key algorithm identifier.
          format: int64
          type: integer
          x-order: 8
        Raw:
          description: The raw ASN.1 DER encoded certificate.
          items:
            format: byte
            type: string
          type: array
          x-order: 1
        RawIssuer:
          description: The raw ASN.1 DER encoded issuer.
          items:
            format: byte
            type: string
          type: array
          x-order: 5
        RawSubject:
          description: The raw ASN.1 DER encoded subject.
          items:
            format: byte
            type: string
          type: array
          x-order: 4
        RawSubjectPublicKeyInfo:
          description: The raw ASN.1 DER encoded SubjectPublicKeyInfo.
          items:
            format: byte
            type: string
          type: array
          x-order: 3
        RawTBSCertificate:
          description: The raw ASN.1 DER encoded TBSCertificate.
          items:
            format: byte
            type: string
          type: array
          x-order: 2
        RequireExplicitPolicy:
          description: The require explicit policy constraint value.
          format: int64
          type: integer
          x-order: 50
        RequireExplicitPolicyZero:
          description: Whether RequireExplicitPolicy was explicitly set to zero.
          type: boolean
          x-order: 51
        SerialNumber:
          description: The certificate serial number.
          format: int64
          type: integer
          x-order: 11
        Signature:
          description: The certificate signature.
          items:
            format: byte
            type: string
          type: array
          x-order: 6
        SignatureAlgorithm:
          description: The signature algorithm identifier.
          format: int64
          type: integer
          x-order: 7
        Subject:
          $ref: '#/components/schemas/PkixName'
          description: The certificate subject distinguished name.
          x-order: 13
        SubjectKeyId:
          description: The subject key identifier extension value.
          items:
            format: byte
            type: string
          type: array
          x-order: 26
        URIs:
          description: URIs from the subject alternative name extension.
          items:
            $ref: '#/components/schemas/NetURL'
          type: array
          x-order: 33
        UnhandledCriticalExtensions:
          description: Critical extensions that were not handled during parsing.
          items:
            type: string
          type: array
          x-order: 19
        UnknownExtKeyUsage:
          description: Unknown extended key usage OIDs.
          items:
            type: string
          type: array
          x-order: 21
        Version:
          description: The X.509 certificate version.
          format: int64
          type: integer
          x-order: 10
      required:
      - AuthorityKeyId
      - BasicConstraintsValid
      - CRLDistributionPoints
      - DNSNames
      - EmailAddresses
      - ExcludedDNSDomains
      - ExcludedEmailAddresses
      - ExcludedIPRanges
      - ExcludedURIDomains
      - ExtKeyUsage
      - Extensions
      - ExtraExtensions
      - IPAddresses
      - InhibitAnyPolicy
      - InhibitAnyPolicyZero
      - InhibitPolicyMapping
      - InhibitPolicyMappingZero
      - IsCA
      - Issuer
      - IssuingCertificateURL
      - KeyUsage
      - MaxPathLen
      - MaxPathLenZero
      - NotAfter
      - NotBefore
      - OCSPServer
      - PermittedDNSDomains
      - PermittedDNSDomainsCritical
      - PermittedEmailAddresses
      - PermittedIPRanges
      - PermittedURIDomains
      - Policies
      - PolicyIdentifiers
      - PolicyMappings
      - PublicKey
      - PublicKeyAlgorithm
      - Raw
      - RawIssuer
      - RawSubject
      - RawSubjectPublicKeyInfo
      - RawTBSCertificate
      - RequireExplicitPolicy
      - RequireExplicitPolicyZero
      - SerialNumber
      - Signature
      - SignatureAlgorithm
      - Subject
      - SubjectKeyId
      - URIs
      - UnhandledCriticalExtensions
      - UnknownExtKeyUsage
      - Version
      type: object
    GetServiceResponse:
      description: Response when requesting a service.
      properties:
        continuationToken:
          description: 'ContinuationToken is an opaque value the client can send to fetch additional

            items. Will be nil once all items have been returned.'
          type: string
          x-order: 3
        items:
          description: The list of service items
          items:
            $ref: '#/components/schemas/ServiceItem'
          type: array
          x-order: 2
        service:
          $ref: '#/components/schemas/Service'
          description: The service details
          x-order: 1
      required:
      - items
      - service
      type: object
    ServiceMember:
      description: 'A service member is either a direct user or a indirect user representation

        that allows them to access and mutate a service.'
      properties:
        avatarUrl:
          description: an optional avatar URL for the member
          type: string
          x-order: 3
        name:
          description: the login name of the member within Pulumi
          type: string
          x-order: 2
        type:
          description: the type of the member (e.g. team / user)
          type: string
          x-order: 1
      required:
      - avatarUrl
      - name
      - type
      type: object
    AngularGridGetRowsRequest:
      description: https://www.ag-grid.com/javascript-data-grid/server-side-model-datasource/
      properties:
        endRow:
          description: The end row
          format: int64
          type: integer
          x-order: 2
        filterModel:
          $ref: '#/components/schemas/AngularGridAdvancedFilterModel'
          description: The filter model
          x-order: 6
        groupKeys:
          description: List of group keys
          items:
            type: string
          type: array
          x-order: 5
        rowGroupCols:
          description: List of row group cols
          items:
            $ref: '#/components/schemas/AngularGridColumn'
          type: array
          x-order: 3
        sortModel:
          description: List of sort model
          items:
            $ref: '#/components/schemas/AngularGridSortModelItem'
          type: array
          x-order: 7
        startRow:
          description: The start row
          format: int64
          type: integer
          x-order: 1
        valueCols:
          description: List of value cols
          items:
            $ref: '#/components/schemas/AngularGridColumn'
          type: array
          x-order: 4
      required:
      - filterModel
      - groupKeys
      - rowGroupCols
      - sortModel
      - valueCols
      type: object
    MemberLinks:
      description: MemberLinks contains hypermedia links related to an organization member.
      properties:
        self:
          description: A self-referencing hypermedia link (URL) to this member resource.
          type: string
          x-order: 1
      type: object
    AppUpdatePolicyGroupRequest:
      description: UpdatePolicyGroupRequest modifies a Policy Group.
      properties:
        addPolicyPack:
          $ref: '#/components/schemas/AppPolicyPackMetadata'
          description: A policy pack to enable for the policy group.
          x-order: 4
        addStack:
          $ref: '#/components/schemas/AppPulumiStackReference'
          description: A stack to add to the policy group.
          x-order: 2
        newName:
          description: The new name to assign to the policy group.
          type: string
          x-order: 1
        removePolicyPack:
          $ref: '#/components/schemas/AppPolicyPackMetadata'
          description: A policy pack to disable for the policy group.
          x-order: 5
        removeStack:
          $ref: '#/components/schemas/AppPulumiStackReference'
          description: A stack to remove from the policy group.
          x-order: 3
      type: object
    TeamAccountPermission:
      description: TeamAccountPermission is the permission team membership grants to an account.
      properties:
        accountName:
          description: The Insights account name.
          type: string
          x-order: 1
        permission:
          description: The permission level the team has on this Insights account.
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int64
          type: integer
          x-order: 2
          x-pulumi-model-property:
            enumTypeName: InsightsAccountPermission
            enumComments: InsightsAccountPermission is a value describing the permission level a user has for a Pulumi Insights account.
            enumFieldNames:
            - None
            - Read
            - Write
            - Admin
            enumFieldComments:
            - InsightsAccountPermissionNone provides no access.
            - InsightsAccountPermissionRead provides read-only access.
            - InsightsAccountPermissionWrite provides read/write access to an account.
            - InsightsAccountPermissionAdmin provides admin-level access to the account.
        permissionSetName:
          description: Display name of the permission set for this account, when available. Enables read-only entity access UI without requiring RoleRead.
          type: string
          x-order: 3
      required:
      - accountName
      - permission
      type: object
    AppEncryptValueResponse:
      description: EncryptValueResponse defines the response body for an encrypted value.
      properties:
        ciphertext:
          description: The encrypted value.
          items:
            format: byte
            type: string
          type: array
          x-order: 1
      required:
      - ciphertext
      type: object
    AggregationBucket:
      description: AggregationBucket represents how many resources share that value.
      properties:
        aggregations:
          additionalProperties:
            $ref: '#/components/schemas/Aggregation'
          description: Map of aggregations
          type: object
          x-order: 3
        count:
          description: The count
          format: int64
          type: integer
          x-order: 2
        name:
          description: The name
          type: string
          x-order: 1
      type: object
    UpdatePolicyIssueRequest:
      description: Request to update a policy issue.
      properties:
        assignedTo:
          description: The user to assign the policy issue to.
          type: string
          x-order: 1
        priority:
          description: The new priority for the policy issue.
          enum:
          - p0
          - p1
          - p2
          - p3
          - p4
          type: string
          x-order: 3
          x-pulumi-model-property:
            enumTypeName: PolicyIssuePriority
            enumComments: Priority level of a policy issue, from P0 (most critical) to P4 (least critical).
        status:
          description: 'The new status for the policy issue. Valid values: open, in_progress, by_design, ignored. Note: fixed cannot be set manually.'
          enum:
          - open
          - in_progress
          - by_design
          - fixed
          - ignored
          type: string
          x-order: 2
          x-pulumi-model-property:
            enumTypeName: PolicyIssueStatus
            enumComments: 'Lifecycle status of a policy issue. Valid values: open, in_progress, by_design, fixed, ignored. Note: fixed is a read-only status set automatically when an issue is resolved; it cannot be manually set via the API.'
            enumFieldNames:
            - Open
            - InProgress
            - ByDesign
            - Fixed
            - Ignored
      type: object
    ListPolicyIssuesResponse:
      description: Response containing a list of policy issues.
      properties:
        groupData:
          description: Grouped data for policy issue aggregation
          items:
            additionalProperties:
              type: object
            type: object
          type: array
          x-order: 2
        policyIssues:
          description: The list of policy issues
          items:
            $ref: '#/components/schemas/PolicyIssue'
          type: array
          x-order: 1
        rowCount:
          description: The total number of policy issue rows
          format: int64
          type: integer
          x-order: 3
      required:
      - groupData
      - policyIssues
      type: object
    ListTeamsResponse:
      description: ListTeamsResponse lists all teams within an organization.
      properties:
        teams:
          description: The list of teams
          items:
            $ref: '#/components/schemas/Team'
          type: array
          x-order: 1
      required:
      - teams
      type: object
    AccessTokenRole:
      description: A role that can be associated with an access token to scope its permissions.
      properties:
        defaultIdentifier:
          description: The default identity to assume when using a token with this role.
          enum:
          - member
          - admin
          - billing-manager
          - stack-read
          - stack-write
          - stack-admin
          - environment-read
          - environment-write
          - environment-admin
          - environment-open
          - insights-account-read
          - insights-account-write
          - insights-account-admin
          type: string
          x-order: 3
          x-pulumi-model-property:
            enumTypeName: DefaultIdentifier
            enumComments: DefaultIdentifier is an enum describing the permission level for a default role.
            enumFieldNames:
            - Member
            - Admin
            - BillingManager
            - StackRead
            - StackWrite
            - StackAdmin
            - EnvironmentRead
            - EnvironmentWrite
            - EnvironmentAdmin
            - EnvironmentOpen
            - InsightsAccountRead
            - InsightsAccountWrite
            - InsightsAccountAdmin
        id:
          description: Unique identifier for this role.
          type: string
          x-order: 1
        name:
          description: Display name of the role.
          type: string
          x-order: 2
      required:
      - defaultIdentifier
      - id
      - name
      type: object
    AppListPolicyGroupsResponse:
      description: ListPolicyGroupsResponse lists a summary of the organization's Policy Groups.
      properties:
        policyGroups:
          description: List of policy groups
          items:
            $ref: '#/components/schemas/AppPolicyGroupSummary'
          type: array
          x-order: 1
      required:
      - policyGroups
      type: object
    RbacScopeMetadata:
      description: Metadata associated with an RBAC scope.
      properties:
        description:
          description: A human-readable description of this scope.
          type: string
          x-order: 1
      required:
      - description
      type: object
    AppListPolicyPacksResponse:
      description: ListPolicyPacksResponse is the response to list an organization's Policy Packs.
      properties:
        policyPacks:
          description: List of policy packs
          items:
            $ref: '#/components/schemas/AppPolicyPackWithVersions'
          type: array
          x-order: 1
      required:
      - policyPacks
      type: object
    RbacScope:
      description: RbacScope represents a permission and its metadata
      properties:
        metadata:
          $ref: '#/components/schemas/RbacScopeMetadata'
          description: Metadata associated with this scope.
          x-order: 2
        name:
          description: The permission name for this scope.
          enum:
          - ''
          - stack:list
          - project:encrypt
          - project:decrypt
          - project_annotations:read
          - project_annotations:update
          - stack:read
          - stack:write
          - stack:import
          - stack:export
          - stack:encrypt
          - stack:decrypt
          - stack:create
          - stack:rename
          - stack:delete
          - stack:cancel_update
          - stack:transfer
          - stack:list_deleted
          - stack:restore_deleted
          - stack_deployment:create
          - stack_deployment:read
          - stack_deployment_settings:write
          - stack_deployment_settings:read
          - stack_deployment_settings:encrypt
          - stack_deployment_cache:read
          - stack_webhook:read
          - stack_webhook:create
          - stack_webhook:update
          - stack_webhook:delete
          - stack_access:read
          - stack_access:update
          - stack_tags:update
          - stack_annotations:read
          - stack_annotations:update
          - stack_schedule:create
          - stack_schedule:update
          - stack_schedule:read
          - stack_schedule:delete
          - stack_schedule:pause
          - stack_schedule:resume
          - organization:read_usage
          - organization:update
          - organization:rename
          - organization:delete
          - organization:change_backend
          - organization:billing
          - organization:potential
          - organization:transfer_stacks
          - saml:read
          - saml:update
          - audit_logs:read
          - audit_logs:export
          - scim:read
          - scim:update
          - scim:delete
          - tags:read
          - org_integrations:read
          - org_integrations:update
          - integrations:update
          - integrations:read
          - invites:read
          - invites:create
          - org_requests:read
          - org_requests:update
          - org_member_access:read
          - org_member:read
          - org_member:delete
          - org_member:add
          - org_member:update
          - org_member:set_admin
          - org_token:read
          - org_token:create
          - org_token:delete
          - auth_policies:read
          - auth_policies:update
          - oidc_issuers:read
          - oidc_issuers:update
          - oidc_issuers:regenerate_thumbprints
          - oidc_issuers:create
          - oidc_issuers:delete
          - agent_pool:read
          - agent_pool:create
          - agent_pool:update
          - agent_pool:delete
          - organization_webhook:read
          - organization_webhook:create
          - organization_webhook:update
          - organization_webhook:delete
          - resources:index
          - resources:search
          - resources:dashboard
          - templates:read
          - templates_source:read
          - templates_source:update
          - templates_source:delete
          - templates_source:create
          - services:create
          - services:read
          - services:write
          - services:admin
          - deployments:read
          - deployments:pause
          - deployments:resume
          - deployments:read_usage
          - organization_annotations:read
          - organization_annotations:update
          - policy_groups:create
          - policy_groups:read
          - policy_groups:update
          - policy_groups:delete
          - policy_pack:create
          - policy_pack:read
          - policy_pack:update
          - policy_pack:delete
          - policy_results:read
          - environment:create
          - environment:list
          - environment:read
          - environment:open
          - environment:write
          - environment:delete
          - environment_settings:read
          - environment_settings:update
          - environment:clone
          - environment:rotate
          - environment:rotate_history
          - environment:list_deleted
          - environment:restore_deleted
          - environment_yaml:open
          - environment_schedule:create
          - environment_schedule:read
          - environment_schedule:update
          - environment_schedule:pause
          - environment_schedule:resume
          - environment_schedule:delete
          - environment_tags:list
          - environment_tag:read
          - environment_tag:create
          - environment_tag:update
          - environment_tag:delete
          - environment_version:create
          - environment_version:read
          - environment_version:update
          - environment_version:delete
          - environment_version:retract
          - environment_version:open
          - environment_webhook:read
          - environment_webhook:create
          - environment_webhook:update
          - environment_webhook:delete
          - environment_access:read
          - environment_access:update
          - team:list
          - team:read
          - team:create
          - team:update
          - team:delete
          - team:create_token
          - team:list_tokens
          - team:delete_token
          - github_team:create
          - insights_account:list
          - insights_account:read
          - insights_account:create
          - insights_account:update
          - insights_account:delete
          - insights_account:update_policy_results
          - insights_account_access:read
          - insights_account_access:update
          - insights_account:scan
          - insights_account_scan:read
          - insights_account_scan:update
          - insights_account_scan:cancel
          - insights_account_scan:pause
          - insights_account_scan:resume
          - insights_policy_queue:read
          - insights_policy_evaluator:read
          - insights_policy_evaluator:delete
          - insights_policy_evaluator:ensure
          - insights_policy_evaluator:update
          - ai_conversations:list_all
          - ai_conversations:read
          - ai_conversations:create
          - ai_conversations:update
          - role:create
          - role:read
          - role:update
          - role:delete
          - change_gate:create
          - change_gate:update
          - change_gate:delete
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: RbacPermission
            enumComments: RbacPermission enumerates the permissions available in the RBAC system.
            enumFieldNames:
            - NoPermission
            - StackList
            - ProjectEncrypt
            - ProjectDecrypt
            - ProjectAnnotationRead
            - ProjectAnnotationUpdate
            - StackRead
            - StackWrite
            - StackImport
            - StackExport
            - StackEncrypt
            - StackDecrypt
            - StackCreate
            - StackRename
            - StackDelete
            - StackCancelUpdate
            - StackTransfer
            - StackListDeleted
            - StackRestoreDeleted
            - StackDeploymentCreate
            - StackDeploymentRead
            - StackDeploymentSettingsWrite
            - StackDeploymentSettingsRead
            - StackDeploymentSettingsEncrypt
            - StackDeploymentCacheRead
            - StackWebhookRead
            - StackWebhookCreate
            - StackWebhookUpdate
            - StackWebhookDelete
            - StackAccessRead
            - StackAccessUpdate
            - StackTagsUpdate
            - StackAnnotationRead
            - StackAnnotationUpdate
            - StackScheduleCreate
            - StackScheduleUpdate
            - StackScheduleRead
            - StackScheduleDelete
            - StackSchedulePause
            - StackScheduleResume
            - OrganizationReadUsage
            - OrganizationUpdate
            - OrganizationRename
            - OrganizationDelete
            - OrganizationChangeBackend
            - OrganizationBilling
            - OrganizationPotential
            - OrganizationTransferStacks
            - SAMLRead
            - SAMLUpdate
            - AuditLogsRead
            - AuditLogsExport
            - SCIMRead
            - SCIMUpdate
            - SCIMDelete
            - TagsRead
            - OrgIntegrationsRead
            - OrgIntegrationsUpdate
            - IntegrationsUpdate
            - IntegrationsRead
            - InvitesRead
            - InvitesCreate
            - OrgRequestsRead
            - OrgRequestsUpdate
            - OrgMemberAccessRead
            - OrgMemberRead
            - OrgMemberDelete
            - OrgMemberAdd
            - OrgMemberUpdate
            - OrgMemberSetAdmin
            - OrgTokenRead
            - OrgTokenCreate
            - OrgTokenDelete
            - AuthPoliciesRead
            - AuthPoliciesUpdate
            - OidcIssuersRead
            - OidcIssuersUpdate
            - OidcIssuersRegenerateThumbprints
            - OidcIssuersCreate
            - OidcIssuersDelete
            - AgentPoolRead
            - AgentPoolCreate
            - AgentPoolUpdate
            - AgentPoolDelete
            - OrganizationWebhookRead
            - OrganizationWebhookCreate
            - OrganizationWebhookUpdate
            - OrganizationWebhookDelete
            - ResourcesIndex
            - ResourcesSearch
            - ResourcesDashboard
            - TemplatesRead
            - TemplatesSourceRead
            - TemplatesSourceUpdate
            - TemplatesSourceDelete
            - TemplatesSourceCreate
            - ServicesCreate
            - ServicesRead
            - ServicesWrite
            - ServicesAdmin
            - DeploymentsRead
            - DeploymentsPause
            - DeploymentsResume
            - DeploymentsReadUsage
            - OrganizationAnnotationsRead
            - OrganizationAnnotationsUpdate
            - InsightsPolicyGroupsCreate
            - InsightsPolicyGroupsRead
            - InsightsPolicyGroupsUpdate
            - InsightsPolicyGroupsDelete
            - InsightsPolicyPackCreate
            - InsightsPolicyPackRead
            - InsightsPolicyPackUpdate
            - InsightsPolicyPackDelete
            - InsightsPolicyResultsRead
            - EnvironmentCreate
            - EnvironmentList
            - EnvironmentRead
            - EnvironmentOpen
            - EnvironmentWrite
            - EnvironmentDelete
            - EnvironmentSettingsRead
            - EnvironmentSettingsUpdate
            - EnvironmentClone
            - EnvironmentRotate
            - EnvironmentRotateHistory
            - EnvironmentListDeleted
            - EnvironmentRestoreDeleted
            - EnvironmentYamlOpen
            - EnvironmentScheduleCreate
            - EnvironmentScheduleRead
            - EnvironmentScheduleUpdate
            - EnvironmentSchedulePause
            - EnvironmentScheduleResume
            - EnvironmentScheduleDelete
            - EnvironmentTagsList
            - EnvironmentTagRead
            - EnvironmentTagCreate
            - EnvironmentTagUpdate
            - EnvironmentTagDelete
            - EnvironmentVersionCreate
            - EnvironmentVersionRead
            - EnvironmentVersionUpdate
            - EnvironmentVersionDelete
            - EnvironmentVersionRetract
            - EnvironmentVersionOpen
            - EnvironmentWebhookRead
            - EnvironmentWebhookCreate
            - EnvironmentWebhookUpdate
            - EnvironmentWebhookDelete
            - EnvironmentAccessRead
            - EnvironmentAccessUpdate
            - TeamList
            - TeamRead
            - TeamCreate
            - TeamUpdate
            - TeamDelete
            - TeamCreateToken
            - TeamListTokens
            - TeamDeleteToken
            - GithubTeamCreate
            - InsightsAccountList
            - InsightsAccountRead
            - InsightsAccountCreate
            - InsightsAccountUpdate
            - InsightsAccountDelete
            - InsightsAccountUpdatePolicyResults
            - InsightsAccountAccessRead
            - InsightsAccountAccessUpdate
            - InsightsAccountScan
            - InsightsAccountScanRead
            - InsightsAccountScanUpdate
            - InsightsAccountScanCancel
            - InsightsAccountScanPause
            - InsightsAccountScanResume
            - InsightsPolicyQueueRead
            - InsightsPolicyEvaluatorRead
            - InsightsPolicyEvaluatorDelete
            - InsightsPolicyEvaluatorEnsure
            - InsightsPolicyEvaluatorUpdate
            - AIConversationsListAll
            - AIConversationsRead
            - AIConversationsCreate
            - AIConversationsUpdate
            - RoleCreate
            - RoleRead
            - RoleUpdate
            - RoleDelete
            - ChangeGateCreate
            - ChangeGateUpdate
            - ChangeGateDelete
            enumFieldComments:
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - OrganizationTransferStacks differs from Stack Transfer as it enables transferring all stacks within the organization, rather than being tied to an individual stack.
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
            - ''
      required:
      - metadata
      - name
      type: object
    CreateTeamAccessTokenRequest:
      allOf:
      - $ref: '#/components/schemas/BaseCreateAccessTokenRequest'
      - description: CreateTeamAccessTokenRequest is the accepted request body for creating a team access token.
        properties:
          name:
            description: The name
            type: string
            x-order: 1
        required:
        - name
        type: object
    AccessToken:
      description: AccessToken holds a pulumi access token and some associated metadata
      properties:
        admin:
          description: Whether this token has Pulumi Cloud admin privileges.
          type: boolean
          x-order: 7
        created:
          description: Timestamp when the token was created, in ISO 8601 format.
          type: string
          x-order: 4
        createdBy:
          description: User.GitHubLogin of the user that created the access token
          type: string
          x-order: 8
        description:
          description: User-provided description of the token's purpose.
          type: string
          x-order: 3
        expires:
          description: Unix epoch timestamp (seconds) when the token expires. Zero if it never expires.
          format: int64
          type: integer
          x-order: 6
        id:
          description: Unique identifier for this access token.
          type: string
          x-order: 1
        lastUsed:
          description: Unix epoch timestamp (seconds) when the token was last used. Zero if never used.
          format: int64
          type: integer
          x-order: 5
        name:
          description: Human-readable name assigned to this access token.
          type: string
          x-order: 2
        role:
          $ref: '#/components/schemas/AccessTokenRole'
          description: Role associated with the token, if applicable
          x-order: 9
      required:
      - admin
      - created
      - createdBy
      - description
      - expires
      - id
      - lastUsed
      - name
      type: object
    AuthPolicyUpdateRequest:
      description: Request body for auth policy update.
      properties:
        policies:
          description: List of policies
          items:
            $ref: '#/components/schemas/AuthPolicyDefinition'
          type: array
          x-order: 1
      required:
      - policies
      type: object
    GetOrgTemplatesResponse:
      description: Response body for retrieving templates available to an organization.
      properties:
        diagnostics:
          description: Diagnostic messages from template retrieval
          items:
            type: string
          type: array
          x-order: 5
        hasAccessError:
          description: Whether there was an access error retrieving templates
          type: boolean
          x-order: 3
        hasUpstreamError:
          description: Whether there was an upstream error retrieving templates
          type: boolean
          x-order: 4
        orgHasTemplates:
          description: Whether the organization has any templates configured
          type: boolean
          x-order: 2
        templates:
          additionalProperties:
            items:
              $ref: '#/components/schemas/PulumiTemplateRemote'
            type: array
          description: Map of template source names to their available templates
          type: object
          x-order: 1
      required:
      - hasAccessError
      - hasUpstreamError
      - orgHasTemplates
      - templates
      type: object
    UserInfo:
      description: 'UserInfo contains just the display information for a user.  This information may be returned from public APIs,

        and as such this structure must not contain sensitive information.  Please refer to User for this sort of thing.'
      properties:
        avatarUrl:
          description: The URL of the user's avatar image.
          type: string
          x-order: 3
        email:
          description: 'IMPORTANT: The email address of the user is only included on a few admin-only APIs.

            For nearly all APIs that return a UserInfo object, this will not be provided.

            considered sensitive information.'
          type: string
          x-order: 4
        githubLogin:
          description: The user's login name.
          type: string
          x-order: 2
        name:
          description: The user's display name.
          type: string
          x-order: 1
      required:
      - avatarUrl
      - githubLogin
      - name
      type: object
    AuditLogExportResult:
      description: AuditLogExportResult is the result of an audit log export or attempt to test access.
      properties:
        message:
          description: 'If the last result was successful, message will be "".

            Any other value is a user-facing error message.'
          type: string
          x-order: 2
        timestamp:
          description: The timestamp
          format: int64
          type: integer
          x-order: 1
      required:
      - message
      - timestamp
      type: object
    PermissionDescriptorRecord:
      allOf:
      - $ref: '#/components/schemas/PermissionDescriptorBase'
      - description: PermissionDescriptorRecord is a persisted permission descriptor with identity and versioning information.
        properties:
          created:
            description: When the role was created.
            format: date-time
            type: string
            x-order: 1
          defaultIdentifier:
            description: The identifier for default roles. Empty for custom roles.
            type: string
            x-order: 5
          id:
            description: The unique identifier for this role.
            type: string
            x-order: 3
          isOrgDefault:
            description: Whether this role is the organization default.
            type: boolean
            x-order: 7
          modified:
            description: When the role was last modified.
            format: date-time
            type: string
            x-order: 2
          orgId:
            description: The ID of the organization this role belongs to.
            type: string
            x-order: 4
          version:
            description: The version of this role.
            format: int32
            type: integer
            x-order: 6
        required:
        - created
        - id
        - isOrgDefault
        - modified
        - orgId
        - version
        type: object
    ListPoliciesComplianceResponse:
      description: Response containing a list of policy compliance results.
      properties:
        continuationToken:
          description: Continuation token for pagination
          type: string
          x-order: 3
        policies:
          description: The list of policy compliance rows
          items:
            $ref: '#/components/schemas/PolicyComplianceRow'
          type: array
          x-order: 1
        totalCount:
          description: The total number of policies
          format: int64
          type: integer
          x-order: 2
      required:
      - policies
      type: object
    SubmitChangeRequestRequest:
      description: SubmitChangeRequestRequest is used to submit a draft change request for approval
      properties:
        description:
          description: Description/justification for the change request
          type: string
          x-order: 1
      type: object
    AppCreateStackRequest:
      description: CreateStackRequest defines the request body for creating a new Stack
      properties:
        config:
          $ref: '#/components/schemas/AppStackConfig'
          description: The configuration for the new stack.
          x-order: 5
        stackName:
          description: The name of the stack being created.
          type: string
          x-order: 1
        state:
          $ref: '#/components/schemas/AppUntypedDeployment'
          description: An optional state to initialize the stack with.
          x-order: 4
        tags:
          additionalProperties:
            type: string
          description: An optional set of tags to apply to the stack.
          type: object
          x-order: 2
        teams:
          description: An optional set of teams to assign to the stack.
          items:
            type: string
          type: array
          x-order: 3
      required:
      - stackName
      type: object
    JobRun:
      description: JobRun contains information about a job run.
      properties:
        lastUpdated:
          description: When the job was last updated
          format: date-time
          type: string
          x-order: 3
        started:
          description: When the job started running
          format: date-time
          type: string
          x-order: 2
        status:
          description: The current status of the job run
          enum:
          - not-started
          - accepted
          - running
          - failed
          - succeeded
          - skipped
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: JobStatus
            enumComments: JobStatus describes the status of a job run.
            enumFieldNames:
            - NotStarted
            - Accepted
            - Running
            - Failed
            - Succeeded
            - Skipped
            enumFieldComments:
            - JobStatusNotStarted indicates that a job has not yet started.
            - JobStatusAccepted indicates that a job has been accepted for execution, but is not yet running.
            - JobStatusRunning indicates that a job is running.
            - JobStatusFailed indicates that a job has failed.
            - JobStatusSucceeded indicates that a job has succeeded.
            - JobStatusSkipped indicates that a job has skipped as there are fresher deployments to execute in the queue.
        steps:
          description: The list of step runs within this job
          items:
            $ref: '#/components/schemas/StepRun'
          type: array
          x-order: 5
        timeout:
          description: The timeout duration for the job in nanoseconds (Go time.Duration).
          format: int64
          type: integer
          x-order: 4
        worker:
          description: Information about the worker executing this job
          type: object
          x-order: 6
      required:
      - status
      - steps
      - timeout
      type: object
    ApproveChangeRequestRequest:
      description: ApproveChangeRequestRequest is used to approve a change request or a specific revision.
      properties:
        comment:
          description: Optional note accompanying the approval
          type: string
          x-order: 2
        revisionNumber:
          description: Which revision to approve.
          format: int64
          type: integer
          x-order: 1
      required:
      - revisionNumber
      type: object
    X509PolicyMapping:
      description: X509PolicyMapping represents a mapping between issuer and subject domain policies in an X.509 certificate.
      properties:
        IssuerDomainPolicy:
          description: The OID of the issuer domain policy.
          type: string
          x-order: 1
        SubjectDomainPolicy:
          description: The OID of the subject domain policy.
          type: string
          x-order: 2
      required:
      - IssuerDomainPolicy
      - SubjectDomainPolicy
      type: object
    ScanStatus:
      allOf:
      - $ref: '#/components/schemas/WorkflowRun'
      - description: The status of an Insights account scan, including resource count.
        properties:
          accountName:
            description: The name of the insights account associated with this scan.
            type: string
            x-order: 1
          resourceCount:
            description: The number of resources discovered by this scan.
            format: int64
            type: integer
            x-order: 2
        type: object
    UpdateOrganizationRequest:
      description: 'UpdateOrganizationRequest is the request object to mutate an Organization''s settings.

        Non nil-fields will overwrite the organization''s settings, leaving existing values intact.'
      properties:
        setAiEnablement:
          description: The AI enablement setting for the organization.
          type: string
          x-order: 10
        setDefaultAccountPermission:
          description: The new default account permission for the organization.
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int64
          type: integer
          x-order: 3
          x-pulumi-model-property:
            enumTypeName: InsightsAccountPermission
            enumComments: InsightsAccountPermission is a value describing the permission level a user has for a Pulumi Insights account.
            enumFieldNames:
            - None
            - Read
            - Write
            - Admin
            enumFieldComments:
            - InsightsAccountPermissionNone provides no access.
            - InsightsAccountPermissionRead provides read-only access.
            - InsightsAccountPermissionWrite provides read/write access to an account.
            - InsightsAccountPermissionAdmin provides admin-level access to the account.
        setDefaultAgentPoolID:
          description: The ID of the default agent pool for the organization. Set to empty string to revert to the Pulumi Hosted Pool.
          type: string
          x-order: 16
        setDefaultDeploymentRoleId:
          description: The ID of the default deployment role. When set, this role is applied to all deployments that do not have a role explicitly configured in their stack deployment settings. Set to an empty string to clear the default.
          type: string
          x-order: 15
        setDefaultEnvironmentPermission:
          description: The new default environment permission for the organization.
          enum:
          - none
          - read
          - open
          - write
          - admin
          type: string
          x-order: 2
          x-pulumi-model-property:
            enumTypeName: EnvironmentPermission
            enumComments: EnvironmentPermission is an enum describing the permission level to access an environment.
        setDefaultStackPermission:
          description: The new default stack permission for the organization.
          enum:
          - 0
          - 101
          - 102
          - 103
          - 104
          format: int64
          type: integer
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: StackPermission
            enumComments: 'StackPermission is a value describing the permission level a user has for a Pulumi stack.

              Like OrganizationRole, there is a total ordering of StackPermission values, where each value

              grants an additional layer of permissions. IMPORTANT: Do not rely on the numeric values for

              auth checks, instead, just refer to these as opaque names. e.g. use explicit matching in a

              case-statements instead of "if perm >= StackPermissionX". This prevents errors if we later

              add a new StackPermission "in between" two existing ones, but with a new, higher value.

              Previously, the StackPermission value was a series of bit flags, with each bit controlling

              a specific operation on the stack. However, that proved difficult to describe and maintain.

              So the newer, "fixed set" approach is used instead.

              The conversion from the legacy permission values and the new StackPermission values is done

              transparently, whenever data is read/written to the database. (Converting to the newer

              values as needed.) We will only be able to remove these legacy values after we deploy the

              code which can read both formats, and only writes the newer format.'
            enumFieldNames:
            - None
            - Read
            - Write
            - Admin
            - Creator
            enumFieldComments:
            - StackPermissionNone provides no access.
            - 'StackPermissionRead provides read-only access, including the ability to

              decrypt encrypted configuration secrets stored in the service.'
            - StackPermissionWrite provides read/write access to a stack.
            - 'StackPermissionAdmin provides admin-level access to the stack. For example,

              being able to run `pulumi destroy` or delete the stack.'
            - 'StackPermissionCreator is an implementation quirk of how we mark the user who created

              a stack. The value is not exported from this module, and is converted to StackPermissionAdmin

              before being returned to callers. However, in a few places we want to handle the user who

              created a stack a little differently, and this allows us to do so without exporting a separate

              "StackPermissionAdminWhoAlsoHappenedToCreateTheStackToo" value.'
        setMembersCanCreateAccounts:
          description: Whether members can create accounts.
          type: boolean
          x-order: 8
        setMembersCanCreateStacks:
          description: Whether members can create stacks.
          type: boolean
          x-order: 4
        setMembersCanCreateTeams:
          description: Whether members can create teams.
          type: boolean
          x-order: 9
        setMembersCanDeleteStacks:
          description: Whether members can delete stacks.
          type: boolean
          x-order: 6
        setMembersCanInviteCollaborators:
          description: Whether members can invite collaborators.
          type: boolean
          x-order: 5
        setMembersCanTransferStacks:
          description: Whether members can transfer stacks.
          type: boolean
          x-order: 7
        setNeoApprovalMode:
          description: The default approval mode for Neo tasks.
          enum:
          - manual
          - auto
          - balanced
          type: string
          x-order: 12
          x-pulumi-model-property:
            enumTypeName: NeoApprovalMode
            enumComments: NeoApprovalMode represents the default approval mode for Neo AI agent tasks in an organization
        setNeoEnabled:
          description: Whether Neo is enabled for the organization.
          type: boolean
          x-order: 11
        setNeoTaskSharingMode:
          description: The task sharing mode for Neo.
          enum:
          - none
          - org
          type: string
          x-order: 13
          x-pulumi-model-property:
            enumTypeName: NeoTaskSharingMode
            enumComments: NeoTaskSharingMode represents the task sharing mode for Neo AI agents in an organization
        setPreferredVCS:
          description: The preferred VCS provider for the organization.
          enum:
          - none
          - bitbucket
          - github
          - gitlab
          type: string
          x-order: 14
          x-pulumi-model-property:
            enumTypeName: PreferredVCS
            enumComments: PreferredVCS represents an organization selected preferred VCS vendor
            enumFieldNames:
            - None
            - Bitbucket
            - GitHub
            - GitLab
      type: object
    AppPolicyGroupSummary:
      description: 'PolicyGroupSummary details the name, applicable stacks and the applied Policy

        Packs for an organization''s Policy Group.'
      properties:
        entityType:
          description: The type of entity this policy group targets (e.g. stacks, accounts).
          enum:
          - stacks
          - accounts
          type: string
          x-order: 5
          x-pulumi-model-property:
            enumTypeName: AppEntityType
            enumComments: EntityType indicates the type of entity a policy group applies to
            enumFieldComments:
            - Stacks indicates the policy group applies to stacks
            - Accounts indicates the policy group applies to accounts
        isOrgDefault:
          description: Whether this is the organization's default policy group, applied to all stacks not in another group.
          type: boolean
          x-order: 2
        mode:
          description: The enforcement mode of the policy group.
          enum:
          - audit
          - preventative
          type: string
          x-order: 6
          x-pulumi-model-property:
            enumTypeName: PolicyGroupMode
            enumComments: PolicyGroupMode represents the enforcement mode for a policy group
        name:
          description: The unique name of the policy group.
          type: string
          x-order: 1
        numAccounts:
          description: Number of cloud accounts assigned to this policy group.
          format: int64
          type: integer
          x-order: 4
        numEnabledPolicyPacks:
          description: Number of policy packs currently enabled in this group.
          format: int64
          type: integer
          x-order: 7
        numStacks:
          description: Number of stacks assigned to this policy group.
          format: int64
          type: integer
          x-order: 3
      required:
      - entityType
      - isOrgDefault
      - mode
      - name
      - numEnabledPolicyPacks
      - numStacks
      type: object
    UpdateOrganizationMemberRequest:
      description: UpdateOrganizationMemberRequest is the request type for updating an organization member.
      properties:
        fgaRoleId:
          description: The ID of a custom role to assign to the member. If both `role` and `fgaRoleId` are provided, `fgaRoleId` takes precedence.
          type: string
          x-order: 2
        role:
          description: The built-in role to assign to the member. Must be `member`, `admin`, or `billing-manager`. Ignored if `fgaRoleId` is also set.
          enum:
          - none
          - member
          - admin
          - potential-member
          - stack-collaborator
          - billing-manager
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: OrganizationRole
            enumComments: OrganizationRole is an enum defining a member's role within an organization.
            enumFieldNames:
            - None
            - Member
            - Admin
            - PotentialMember
            - StackCollaborator
            - BillingManager
            enumFieldComments:
            - OrganizationRoleNone describes the role of non-members.
            - OrganizationRoleMember is the role for regular members.
            - OrganizationRoleAdmin is the role for admins.
            - 'OrganizationRolePotentialMember is the role for users who are explicitly

              not a member of the organization, but are a member of the backing org on

              the 3rd party identity provider. (i.e. they could join the org.)'
            - 'OrganizationRoleStackCollaborator is the role for users who are not a member

              of an organization, but have been explicitly granted access to some of the

              organization''s stacks. So they have limited permissions to access the org''s

              data.'
            - OrganizationRoleBillingManager is the role for billing admins.
      type: object
    TargetEntity:
      description: TargetEntity contains populated details about the targeted entity for a change request or gate
      discriminator:
        mapping:
          environment: '#/components/schemas/TargetEntityEnvironment'
        propertyName: entityType
      properties:
        entityType:
          type: string
      required:
      - entityType
      type: object
    UpdateSummary:
      description: UpdateSummary contains a subset of the update data found in apitype.UpdateInfo.
      properties:
        endTime:
          description: The end time of the update as a Unix timestamp.
          format: int64
          type: integer
          x-order: 3
        resourceCount:
          description: 'ResourceCount is the current resource count for the update. Note that it

            doesn''t reflect the Stack''s current resource count, only that particular

            update. (So the UpdateSummary for the same Stack will be different.)'
          format: int64
          type: integer
          x-order: 4
        result:
          description: The result of the update.
          enum:
          - not-started
          - in-progress
          - succeeded
          - failed
          type: string
          x-order: 1
          x-pulumi-model-property:
            enumTypeName: AppUpdateResult
            enumComments: 'UpdateResult is an enum for the result of the update.

              Should generally mirror backend.UpdateResult, but we clone it in this package to add

              flexibility in case there is a breaking change in the backend-type.'
            enumFieldNames:
            - NotStarted
            - InProgress
            - Succeeded
            - Failed
            enumFieldComments:
            - The update has not started.
            - The update has not yet completed.
            - The update completed successfully.
            - The update has failed.
        startTime:
          description: The start time of the update as a Unix timestamp.
          format: int64
          type: integer
          x-order: 2
      required:
      - endTime
      - resourceCount
      - result
      - startTime
      type: object
    CreateAccessTokenResponse:
      description: 'CreateAccessTokenResponse is the shape of the response after creating a token. The ID is an opaque ID that can be used

        in future CRUD operations and the Token is the actual token value (that is presented in the authorization header).'
      properties:
        id:
          description: The unique identifier
          type: string
          x-order: 1
        tokenValue:
          description: The token value
          type: string
          x-order: 2
      required:
      - id
      - tokenValue
      type: object
    TeamEnvironmentSettings:
      description: TeamEnvironmentSettings contains additional settings a team applies to an environment.
      properties:
        envName:
          description: The environment within the project.
          type: string
          x-order: 2
        maxOpenDuration:
          description: The maximum duration an environment session can remain open, as a Go duration string (e.g. "1h30m").
          type: string
          x-order: 4
        permission:
          description: The permission level the team has on this environment.
          enum:
          - none
          - read
          - open
          - write
          - admin
          type: string
          x-order: 3
          x-pulumi-model-property:
            enumTypeName: EnvironmentPermission
            enumComments: EnvironmentPermission is an enum describing the permission level to access an environment.
        permissionSetName:
          description: Display name of the permission set for this environment, when available. Enables read-only entity access UI without requiring RoleRead.
          type: string
          x-order: 5
        projectName:
          description: The project containing the environment.
          type: string
          x-order: 1
      required:
      - envName
      - permission
      - projectName
      type: object
    Service:
      description: 'A service is a Pulumi construct that aggregates items and additional metadata

        that can be accessed by the service''s members.'
      properties:
        created:
          description: the time the service was create
          format: date-time
          type: string
          x-order: 5
        description:
          description: an optional description of the service
          type: string
          x-order: 4
        itemCountSummary:
          additionalProperties:
            format: int64
            type: integer
          description: item types to their count within the service based on the current user's permissions
          type: object
          x-order: 7
        members:
          description: a list of members that have access to the service
          items:
            $ref: '#/components/schemas/ServiceMember'
          type: array
          x-order: 6
        name:
          description: the name of the service
          type: string
          x-order: 3
        organizationName:
          description: the name of the organization this service belongs to
          type: string
          x-order: 1
        owner:
          $ref: '#/components/schemas/ServiceMember'
          description: the owner of the service
          x-order: 2
        properties:
          description: an optional list of properties set on the service
          items:
            $ref: '#/components/schemas/ServiceProperty'
          type: array
          x-order: 8
      required:
      - description
      - itemCountSummary
      - members
      - name
      - organizationName
      - owner
      - properties
      type: object
    ResourceSearchResult:
      description: ResourceSearchResult is a collected of resource search results.
      properties:
        aggregations:
          additionalProperties:
            $ref: '#/components/schemas/Aggregation'
          description: Aggregation buckets for faceted search.
          type: object
          x-order: 3
        pagination:
          $ref: '#/components/schemas/ResourceSearchPagination'
          description: Pagination links for navigating through results.
          x-order: 4
        resources:
          description: The list of matching resource results.
          items:
            $ref: '#/components/schemas/ResourceResult'
          type: array
          x-order: 2
        total:
          description: The total number of matching resources.
          format: int64
          type: integer
          x-order: 1
      type: object
    ServiceItem:
      description: An item within a service.
      properties:
        addedByUser:
          $ref: '#/components/schemas/ServiceMember'
          description: who added the item reference to the service - this will always be a user
          x-order: 7
        cloudCount:
          description: how many Pulumi cloud measured primitives are within this item
          format: int64
          type: integer
          x-order: 8
        created:
          description: timestamp of when the item was  created
          format: date-time
          type: string
          x-order: 5
        lastUpdate:
          $ref: '#/components/schemas/ServiceItemUpdate'
          description: when did the last update occur to this item, if any
          x-order: 6
        name:
          description: the name (including any namespacing) of the item
          type: string
          x-order: 3
        organizationName:
          description: the name of the organization this item belongs to
          type: string
          x-order: 1
        type:
          description: the type of the item
          type: string
          x-order: 2
        version:
          description: optional field if the item has versioning
          type: string
          x-order: 4
      required:
      - cloudCount
      - created
      - name
      - organizationName
      - type
      type: object
    TransferAllStacksRequest:
      description: 'TransferAllStacksRequest request object for `transferring` ownership of all stacks

        from one organization to another.'
      properties:
        fromOrg:
          description: The source organization to transfer stacks from. Must match the organization in the URL route.
          type: string
          x-order: 1
        toOrg:
          description: The destination organization to transfer stacks to.
          type: string
          x-order: 2
      required:
      - fromOrg
      - toOrg
      type: object
    CreateChangeGateRequest:
      description: CreateChangeGateRequest represents the request to create a new change gate
      properties:
        enabled:
          description: Whether the change gate is enabled
          type: boolean
          x-order: 2
        name:
          description: Name of the change gate
          type: string
          x-order: 1
        rule:
          $ref: '#/components/schemas/ChangeGateRuleInput'
          description: Rule configuration for the gate
          x-order: 3
        target:
          $ref: '#/components/schemas/ChangeGateTargetInput'
          description: Target configuration for the gate
          x-order: 4
      required:
      - enabled
      - name
      - rule
      - target
      type: object
    UpdateOrganizationAuditLogExportSettingsRequest:
      description: 'UpdateOrganizationAuditLogExportSettingsRequest is the request type when making

        changes to an existing audit log export configuration.'
      properties:
        newEnabled:
          description: Whether the audit log export is enabled.
          type: boolean
          x-order: 1
        newS3Configuration:
          $ref: '#/components/schemas/AuditLogsExportS3Config'
          description: The new S3 configuration for audit log export.
          x-order: 2
      required:
      - newEnabled
      - newS3Configuration
      type: object
    OrganizationMetadata:
      description: OrganizationMetadata contains configuration, subscription, and feature information for an organization.
      properties:
        accountCount:
          description: 'AccountCount is the current number of Insights Accounts in the organization.

            (May be more than the requesting user has permission to see.)'
          format: int64
          type: integer
          x-order: 30
        aiEnablement:
          description: The AI feature enablement status for the organization (e.g. enabled, disabled, opt-in).
          type: string
          x-order: 25
        auditLogsEnabled:
          description: Deprecated. Access the AuditLogsEnabled feature from the Features property.
          type: boolean
          x-order: 27
        backingOrgLogin:
          description: The login name of the backing organization on the identity provider.
          type: string
          x-order: 4
        created:
          description: The time the organization was created.
          format: date-time
          type: string
          x-order: 3
        defaultAccountPermission:
          description: 'DefaultAccountPermission is the default permission every member

            has for accessing the organization''s insight accounts.'
          enum:
          - 0
          - 1
          - 2
          - 3
          format: int64
          type: integer
          x-order: 13
          x-pulumi-model-property:
            enumTypeName: InsightsAccountPermission
            enumComments: InsightsAccountPermission is a value describing the permission level a user has for a Pulumi Insights account.
            enumFieldNames:
            - None
            - Read
            - Write
            - Admin
            enumFieldComments:
            - InsightsAccountPermissionNone provides no access.
            - InsightsAccountPermissionRead provides read-only access.
            - InsightsAccountPermissionWrite provides read/write access to an account.
            - InsightsAccountPermissionAdmin provides admin-level access to the account.
        defaultDeploymentRoleId:
          description: DefaultDeploymentRoleID is the ID of the default role used for deployments when no specific role is configured in the stack's deployment settings. If unset, deployments run using the triggering user's own permissions.
          type: string
          x-order: 38
        defaultEnvironmentPermission:
          description: 'DefaultEnvironmentPermission is the default permission every member

            has for accessing the organization''s environments.'
          enum:
          - none
          - read
          - open
          - write
          - admin
          type: string
          x-order: 12
          x-pulumi-model-property:
            enumTypeName: EnvironmentPermission
            enumComments: EnvironmentPermission is an enum describing the permission level to access an environment.
        defaultRoleId:
          description: 'DefaultRoleID is the ID of the default role for new users added to the organization.

            If unset, defaults to the "Member" role.'
          type: string
          x-order: 37
        defaultStackPermission:
          description: 'DefaultStackPermission is the default permission every member

            has for accessing the organization''s stacks.'
          enum:
          - 0
          - 101
          - 102
          - 103
          - 104
          format: int64
          type: integer
          x-order: 11
          x-pulumi-model-property:
            enumTypeName: StackPermission
            enumComments: 'StackPermission is a value describing the permission level a user has for a Pulumi stack.

              Like OrganizationRole, there is a total ordering of StackPermission values, where each value

              grants an additional layer of permissions. IMPORTANT: Do not rely on the numeric values for

              auth checks, instead, just refer to these as opaque names. e.g. use explicit matching in a

              case-statements instead of "if perm >= StackPermissionX". This prevents errors if we later

              add a new StackPermission "in between" two existing ones, but with a new, higher value.

              Previously, the StackPermission value was a series of bit flags, with each bit controlling

              a specific operation on the stack. However, that proved difficult to describe and maintain.

              So the newer, "fixed set" approach is used instead.

              The conversion from the legacy permission values and the new StackPermission values is done

              transparently, whenever data is read/written to the database. (Converting to the newer

              values as needed.) We will only be able to remove these legacy values after we deploy the

              code which can read both formats, and only writes the newer format.'
            enumFieldNames:
            - None
            - Read
            - Write
            - Admin
            - Creator
            enumFieldComments:
            - StackPermissionNone provides no access.
            - 'StackPermissionRead provides read-only access, including the ability to

              decrypt encrypted configuration secrets stored in the service.'
            - StackPermissionWrite provides read/write access to a stack.
            - 'StackPermissionAdmin provides admin-level access to the stack. For example,

              being able to run `pulumi destroy` or delete the stack.'
            - 'StackPermissionCreator is an implementation quirk of how we mark the user who created

              a stack. The value is not exported from this module, and is converted to StackPermissionAdmin

              before being returned to callers. However, in a few places we want to handle the user who

              created a stack a little differently, and this allows us to do so without exporting a separate

              "StackPermissionAdminWhoAlsoHappenedToCreateTheStackToo" value.'
        environmentCount:
          description: 'EnvironmentCount is the current number of environments in the organization.

            (May be more than the requesting user has permission to see.)'
          format: int64
          type: integer
          x-order: 31
        features:
          $ref: '#/components/schemas/OrganizationFeatures'
          description: The feature flags enabled for this organization, controlling access to specific functionality.
          x-order: 29
        id:
          description: The unique identifier of the organization.
          type: string
          x-order: 1
        insightsBillingAccepted:
          description: true if accepted, false if denied, nil if no action taken
          type: boolean
          x-order: 23
        insightsTrialEnd:
          description: The Unix timestamp when the Insights trial ends.
          format: int64
          type: integer
          x-order: 22
        insightsTrialUsingPolicy:
          description: true if org needs to be upgraded to business critical
          type: boolean
          x-order: 24
        kind:
          description: The kind of backing identity provider for the organization.
          enum:
          - single-user
          - bitbucket
          - github
          - gitlab
          - pulumi
          - saml
          type: string
          x-order: 2
          x-pulumi-model-property:
            enumTypeName: OrganizationKind
            enumComments: OrganizationKind describes the backing data source for a Pulumi organization.
            enumFieldNames:
            - SingleUser
            - Bitbucket
            - GitHub
            - GitLab
            - Pulumi
            - SAML
            enumFieldComments:
            - OrganizationKindSingleUser is a Pulumi organization based around a single user.
            - OrganizationKindBitbucket is a Pulumi organization based on a proper Bitbucket team.
            - OrganizationKindGitHub is a Pulumi organization based on a proper GitHub organization.
            - OrganizationKindGitLab is a Pulumi organization based on a proper GitLab group.
            - OrganizationKindPulumi is a Pulumi organization where membership is managed entirely by Pulumi.
            - OrganizationKindSAML is a Pulumi organization based on a SAML SSO identity provider.
        locked:
          description: 'Locked is non-nil if an organization is locked, indicating the specific

            reason why it was locked. (Which may determine which actions are available in the Console.)'
          enum:
          - bad-subscription
          - not-locked
          - read-only
          - rename-in-progress
          - transfer-in-progress
          type: string
          x-order: 36
          x-pulumi-model-property:
            enumTypeName: OrganizationLockedStatus
            enumComments: OrganizationLockedStatus describes why an organization may be locked or restricted.
            enumFieldNames:
            - BadSubscription
            - NotLocked
            - ReadOnly
            - RenameInProgress
            - TransferInProgress
        maxMembers:
          description: 'MaxMembers is the maximum number of members the organization can have

            based on its subscription. (Only set for per-member billed orgs.)'
          format: int64
          type: integer
          x-order: 35
        maxStacks:
          description: 'MaxStacks is the maximum number of stacks the organization can have

            based on its subscription. Will be nil/omitted if there is no limit.'
          format: int64
          type: integer
          x-order: 33
        memberCount:
          description: 'MemberCount is the number of members the organization has. Will be

            incorrect for organizations on the TeamPerStack subscription plan.'
          format: int64
          type: integer
          x-order: 34
        membersCanCreateAccounts:
          description: Whether organization members can create Insights accounts.
          type: boolean
          x-order: 18
        membersCanCreateStacks:
          description: Whether organization members can create stacks.
          type: boolean
          x-order: 14
        membersCanCreateTeams:
          description: Whether organization members can create teams.
          type: boolean
          x-order: 17
        membersCanDeleteStacks:
          description: Whether organization members can delete stacks.
          type: boolean
          x-order: 15
        membersCanTransferStacks:
          description: Whether organization members can transfer stacks.
          type: boolean
          x-order: 16
        neoApprovalMode:
          description: neoApprovalMode is the default approval mode for new Neo AI agent tasks.
          enum:
          - manual
          - auto
          - balanced
          type: string
          x-order: 20
          x-pulumi-model-property:
            enumTypeName: NeoApprovalMode
            enumComments: NeoApprovalMode represents the default approval mode for Neo AI agent tasks in an organization
        neoEnabled:
          description: Whether Neo AI agent features are enabled for the organization.
          type: boolean
          x-order: 19
        neoTaskSharingMode:
          description: NeoTaskSharingMode is the task sharing mode for Neo AI agents in the organization.
          enum:
          - none
          - org
          type: string
          x-order: 21
          x-pulumi-model-property:
            enumTypeName: NeoTaskSharingMode
            enumComments: NeoTaskSharingMode represents the task sharing mode for Neo AI agents in an organization
        preferredVCS:
          description: The organization's preferred VCS vendor.
          enum:
          - none
          - bitbucket
          - github
          - gitlab
          type: string
          x-order: 26
          x-pulumi-model-property:
            enumTypeName: PreferredVCS
            enumComments: PreferredVCS represents an organization selected preferred VCS vendor
            enumFieldNames:
            - None
            - Bitbucket
            - GitHub
            - GitLab
        product:
          description: 'Subscription-related information if the organization has a Pulumi subscription.

            Otherwise, assume it is a grandfathered TeamPerStack org or in the Community Edition.'
          enum:
          - team-per-stack
          - community
          - individual
          - team-starter
          - team-pro
          - enterprise
          - team-growth
          - enterprise-growth
          - business-critical
          type: string
          x-order: 5
          x-pulumi-model-property:
            enumTypeName: SaasOffer
            enumComments: SaasOffer is an enum describing the type of products offered from the Pulumi Service.
            enumFieldNames:
            - TeamPerStack
            - Community
            - Individual
            - TeamStarter
            - TeamPro
            - Enterprise
            - TeamGrowth
            - EnterpriseGrowth
            - BusinessCritical
            enumFieldComments:
            - SaasOfferTeamPerStack Team Edition, billed per-stack.
            - SaasOfferCommunity Community Edition.
            - SaasOfferIndividual TBD individual edition.
            - SaasOfferTeamStarter Team Edition, billed per-member.
            - SaasOfferTeamPro Team Edition, billed per-member.
            - SaasOfferEnterprise Enterprise Edition, billed per-member.
            - SaasOfferTeamGrowth acts like Team Starter, but is billed by consumption.
            - 'SaasOfferEnterpriseGrowth acts like the Pulumi Enterprise edition,

              but is billed by consumption.'
            - SaasOfferBusinessCritical is the business critical edition, billed by consumption.
        stackCount:
          description: 'StackCount is the current number of stacks in the organization.

            (May be more than the requesting user has permission to see.)'
          format: int64
          type: integer
          x-order: 32
        subscriptionCancelAtPeriodEnd:
          description: Whether the subscription will be canceled at the end of the current billing period.
          type: boolean
          x-order: 8
        subscriptionPeriodEnd:
          description: The time when the current subscription or license period ends. For SaaS subscriptions this is the Stripe billing period end. For self-hosted installations this is the license expiry date.
          format: date-time
          type: string
          x-order: 9
        subscriptionStatus:
          description: The Stripe subscription status (e.g. active, past_due, canceled), if applicable.
          type: string
          x-order: 6
        subscriptionTrialEnd:
          description: The Unix timestamp when the subscription trial ends.
          format: int64
          type: integer
          x-order: 7
        userRole:
          description: UserRole is the requesting user's role in the organization.
          enum:
          - none
          - member
          - admin
          - potential-member
          - stack-collaborator
          - billing-manager
          type: string
          x-order: 10
          x-pulumi-model-property:
            enumTypeName: OrganizationRole
            enumComments: OrganizationRole is an enum defining a member's role within an organization.
            enumFieldNames:
            - None
            - Member
            - Admin
            - PotentialMember
            - StackCollaborator
            - BillingManager
            enumFieldComments:
            - OrganizationRoleNone describes the role of non-members.
            - OrganizationRoleMember is the role for regular members.
            - OrganizationRoleAdmin is the role for admins.
            - 'OrganizationRolePotentialMember is the role for users who are explicitly

              not a member of the organization, but are a member of the backing org on

              the 3rd party identity provider. (i.e. they could join the org.)'
            - 'OrganizationRoleStackCollaborator is the role for users who are not a member

              of an organization, but have been explicitly granted access to some of the

              organization''s stacks. So they have limited permissions to access the org''s

              data.'
            - OrganizationRoleBillingManager is the role for billing admins.
        webhooksEnabled:
          description: Deprecated. Access the WebhooksEnabled feature from the Features property.
          type: boolean
          x-order: 28
      required:
      - accountCount
      - aiEnablement
      - auditLogsEnabled
      - created
      - defaultAccountPermission
      - defaultEnvironmentPermission
      - defaultStackPermission
      - environmentCount
      - features
      - id
      - insightsTrialUsingPolicy
      - kind
      - memberCount
      - membersCanCreateAccounts
      - membersCanCreateStacks
      - membersCanCreateTeams
      - membersCanDeleteStacks
      - membersCanTransferStacks
      - neoApprovalMode
      - neoEnabled
      - neoTaskSharingMode
      - preferredVCS
      - stackCount
      - userRole
      - webhooksEnabled
      type: object
    PolicyResultsMetadata:
      description: PolicyResultsMetadata returns high level policy compliance statistics for an organization.
      properties:
        policyTotalCount:
          description: Total number of policies
          format: int64
          type: integer
          x-order: 1
        policyWithIssuesCount:
          description: Number of policies with issues
          format: int64
          type: integer
          x-order: 2
        resourcesTotalCount:
          description: Total number of resources covered by policies
          format: int64
          type: integer
          x-order: 3
        resourcesWithIssuesCount:
          description: Number of resources with issues
          format: int64
          type: integer
          x-order: 4
      required:
      - policyTotalCount
      - policyWithIssuesCount
      - resourcesTotalCount
      - resourcesWithIssuesCount
      type: object
    SAMLOrganization:
      description: SAMLOrganization is a Pulumi organization combined with its SAML-specific data.
      properties:
        entityId:
          description: 'The following fields can be empty if the metadata (IDPSSODescriptor)

            itself is empty for the organization.'
          type: string
          x-order: 3
        idpSsoDescriptor:
          description: The SAML Identity Provider SSO descriptor XML.
          type: string
          x-order: 2
        nameIdFormat:
          description: The SAML NameID format used by the identity provider.
          type: string
          x-order: 6
        organization:
          $ref: '#/components/schemas/Organization'
          description: The Pulumi organization.
          x-order: 1
        ssoUrl:
          description: The SSO URL for the identity provider.
          type: string
          x-order: 4
        validUntil:
          description: 'ValidUntil is the date until which the X.509 Certificate

            issued to the organization by the identity provider is valid.'
          type: string
          x-order: 5
        validationError:
          description: ValidationError will be set only if there is an error validating the SAML org's metadata XML.
          type: string
          x-order: 7
      required:
      - idpSsoDescriptor
      - organization
      type: object
    AppBatchDecryptResponse:
      description: 'BatchDecryptResponse defines the response body for batch decrypted secret values. The key in

        the map is the base64 encoding of the ciphertext.'
      properties:
        plaintexts:
          additionalProperties:
            items:
              format: byte
              type: string
            type: array
          description: Map of plaintexts
          type: object
          x-order: 1
      required:
      - plaintexts
      type: object
    PolicyIssueFiltersRequest:
      description: PolicyIssueFiltersRequest is a request to retrieve available filter values for policy issues.
      properties:
        field:
          description: Field name
          type: string
          x-order: 2
        filterModel:
          $ref: '#/components/schemas/AngularGridAdvancedFilterModel'
          description: Optional filter model to apply when getting available filter values. Same format as used in policy issues list.
          x-order: 1
      required:
      - field
      type: object
    PolicyGroup:
      description: PolicyGroup details the name, applicable entities and the applied PolicyPacks.
      properties:
        accounts:
          description: List of Insights account names that are members of this policy group.
          items:
            type: string
          type: array
          x-order: 7
        agentPoolId:
          description: Agent pool ID for audit policy evaluation. Defaults to Pulumi hosted pool if not specified.
          type: string
          x-order: 8
        appliedPolicyPacks:
          description: List of policy packs that are applied to this policy group.
          items:
            $ref: '#/components/schemas/AppPolicyPackMetadata'
          type: array
          x-order: 6
        entityType:
          description: The type of entities this policy group applies to (stacks or accounts).
          enum:
          - stacks
          - accounts
          type: string
          x-order: 3
          x-pulumi-model-property:
            enumTypeName: PolicyGroupEntityType
            enumComments: PolicyGroupEntityType represents the type of entities a policy group applies to
        isOrgDefault:
          description: True if this is either the default stacks or default accounts policy group for the organization.
          type: boolean
          x-order: 2
        mode:
          description: The enforcement mode for the policy group (audit or preventative).
          enum:
          - audit
          - preventative
          type: string
          x-order: 4
          x-pulumi-model-property:
            enumTypeName: PolicyGroupMode
            enumComments: PolicyGroupMode represents the enforcement mode for a policy group
        name:
          description: The name of the policy group.
          type: string
          x-order: 1
        stacks:
          description: List of stacks that are members of this policy group.
          items:
            $ref: '#/components/schemas/AppPulumiStackReference'
          type: array
          x-order: 5
      required:
      - accounts
      - appliedPolicyPacks
      - entityType
      - isOrgDefault
      - mode
      - name
      - stacks
      type: object
    NetURL:
      description: NetURL represents a parsed URL (Uniform Resource Locator).
      properties:
        ForceQuery:
          description: Whether to force a trailing question mark even if the query is empty.
          type: boolean
          x-order: 8
        Fragment:
          description: The URL fragment (without the leading hash).
          type: string
          x-order: 10
        Host:
          description: The host or host:port of the URL.
          type: string
          x-order: 4
        OmitHost:
          description: Whether to omit the host in the URL string.
          type: boolean
          x-order: 7
        Opaque:
          description: The opaque data of the URL.
          type: string
          x-order: 2
        Path:
          description: The path of the URL.
          type: string
          x-order: 5
        RawFragment:
          description: The encoded fragment hint.
          type: string
          x-order: 11
        RawPath:
          description: The encoded path hint, used when the path contains escaped characters.
          type: string
          x-order: 6
        RawQuery:
          description: The encoded query string, without the leading question mark.
          type: string
          x-order: 9
        Scheme:
          description: The URL scheme (e.g. https, http).
          type: string
          x-order: 1
        User:
          description: The user information associated with the URL.
          type: string
          x-order: 3
      required:
      - ForceQuery
      - Fragment
      - Host
      - OmitHost
      - Opaque
      - Path
      - RawFragment
      - RawPath
      - RawQuery
      - Scheme
      - User
      type: object
    InsightsAccount:
      description: A cloud account configured for Pulumi Insights resource discovery.
      properties:
        agentPoolID:
          description: 'The ID of the agent pool to run account discovery workflows.

            If not specified, discovery will use the default agent pool.'
          type: string
          x-order: 8
        id:
          description: ID of the account.
          type: string
          x-order: 1
        name:
          description: The name of the account.
          type: string
          x-order: 2
        ownedBy:
          $ref: '#/components/schemas/UserInfo'
          description: The user with ownership of this Insights account
          x-order: 3
        provider:
          description: The cloud provider for the account (e.g., aws, gcp, azure-native).
          type: string
          x-order: 4
        providerConfig:
          description: Provider-specific configuration for the account.
          type: object
          x-order: 9
        providerEnvRef:
          description: 'Reference to an ESC environment containing provider credentials,

            in the format ''project/environment'' with an optional @version suffix.'
          type: string
          x-order: 6
        providerVersion:
          description: The version of the Pulumi provider package used for discovery.
          type: string
          x-order: 5
        scanStatus:
          $ref: '#/components/schemas/ScanStatus'
          description: Status of the last discovery scan for this account.
          x-order: 10
        scheduledScanEnabled:
          description: If true, the account is scheduled for recurring discovery.
          type: boolean
          x-order: 7
      required:
      - id
      - name
      - ownedBy
      - provider
      - scheduledScanEnabled
      type: object
    PolicyGroupMetadata:
      description: PolicyGroupMetadata returns policy protection metrics for an organization.
      properties:
        AuditStackResources:
          description: Number of resources in stacks in audit policy groups
          format: int32
          type: integer
          x-order: 6
        AuditStacks:
          description: Number of stacks in audit policy groups
          format: int32
          type: integer
          x-order: 5
        PreventativeStackResources:
          description: Number of resources in stacks in preventative policy groups
          format: int32
          type: integer
          x-order: 4
        PreventativeStacks:
          description: Number of stacks in preventative policy groups
          format: int32
          type: integer
          x-order: 3
        ProtectedAccountResources:
          description: Number of resources in accounts in policy groups
          format: int32
          type: integer
          x-order: 10
        ProtectedAccounts:
          description: Number of accounts in policy groups
          format: int32
          type: integer
          x-order: 9
        ProtectedStackResources:
          description: 'Number of resources in unique stacks in any policy group (preventative or audit). Deprecated: Use PreventativeStackResources and AuditStackResources for breakdown by mode'
          format: int32
          type: integer
          x-order: 2
        ProtectedStacks:
          description: 'Number of unique stacks in any policy group (preventative or audit). Deprecated: Use PreventativeStacks and AuditStacks for breakdown by mode'
          format: int32
          type: integer
          x-order: 1
        TotalAccountResources:
          description: Total number of resources in all accounts
          format: int32
          type: integer
          x-order: 12
        TotalAccounts:
          description: Total number of accounts in the organization
          format: int32
          type: integer
          x-order: 11
        TotalStackResources:
          description: Total number of resources in all stacks
          format: int32
          type: integer
          x-order: 8
        TotalStacks:
          description: Total number of stacks in the organization
          format: int32
          type: integer
          x-order: 7
      required:
      - AuditStackResources
      - AuditStacks
      - PreventativeStackResources
      - PreventativeStacks
      - ProtectedAccountResources
      - ProtectedAccounts
      - ProtectedStackResources
      - ProtectedStacks
      - TotalAccountResources
      - TotalAccounts
      - TotalStackResources
      - TotalStacks
      type: object
    ResourceResult:
      description: 'ResourceResult is the user-facing type for our indexed resources.

        If you add a property here, don''t forget to update fieldMappings to make it

        queryable!'
      properties:
        account:
          description: The Insights account name that discovered or manages this resource.
          type: string
          x-order: 24
        category:
          description: The category of the resource.
          type: string
          x-order: 23
        created:
          description: The ISO 8601 timestamp when the resource was first indexed.
          type: string
          x-order: 1
        custom:
          description: Whether this is a custom resource managed by a provider plugin.
          type: boolean
          x-order: 2
        delete:
          description: Whether this resource is pending deletion.
          type: boolean
          x-order: 3
        dependencies:
          description: URNs of resources that this resource depends on.
          items:
            type: string
          type: array
          x-order: 4
        dependents:
          description: URNs of resources that depend on this resource.
          items:
            type: string
          type: array
          x-order: 25
        external:
          description: Whether the lifecycle of this resource is not managed by Pulumi.
          type: boolean
          x-order: 5
        fingerprint:
          description: A fingerprint uniquely identifying this resource's state.
          type: string
          x-order: 27
        id:
          description: The provider-assigned resource ID.
          type: string
          x-order: 6
        managed:
          description: Whether this resource is managed by Pulumi IaC stacks or discovered by Insights scanning. One of 'managed' or 'discovered'.
          type: string
          x-order: 26
        matches:
          additionalProperties:
            items:
              type: object
            type: array
          description: Matched search terms mapped to their highlighted values.
          type: object
          x-order: 7
        metadata:
          description: Additional metadata associated with the resource.
          type: object
          x-order: 22
        modified:
          description: The ISO 8601 timestamp when the resource was last updated in the index.
          type: string
          x-order: 8
        module:
          description: The module that contains this resource.
          type: string
          x-order: 9
        name:
          description: The name of the resource.
          type: string
          x-order: 10
        package:
          description: The package that provides this resource.
          type: string
          x-order: 11
        parent_urn:
          description: The URN of the parent resource, if any.
          type: string
          x-order: 12
        pending:
          description: The pending operation on this resource, if any (e.g. creating, updating, deleting).
          type: string
          x-order: 13
        project:
          description: The project that contains this resource.
          type: string
          x-order: 14
        properties:
          description: The resource's input/output properties as a JSON object. Only populated when explicitly requested.
          type: object
          x-order: 21
        protected:
          description: Whether this resource is protected from deletion.
          type: boolean
          x-order: 15
        provider_urn:
          description: The URN of the provider for this resource.
          type: string
          x-order: 16
        sourceCount:
          description: The number of sources for this resource.
          format: int64
          type: integer
          x-order: 28
        stack:
          description: The stack that contains this resource.
          type: string
          x-order: 17
        teams:
          description: The teams that have access to this resource.
          items:
            type: string
          type: array
          x-order: 20
        type:
          description: The full type token of the resource (e.g. aws:s3/bucket:Bucket).
          type: string
          x-order: 18
        urn:
          description: The URN uniquely identifying this resource within a stack.
          type: string
          x-order: 19
      required:
      - module
      - package
      type: object
    ServiceProperty:
      description: A property that the service will show in it's metadata.
      properties:
        key:
          description: the name of the property
          type: string
          x-order: 1
        order:
          description: the position of the property
          format: int64
          type: integer
          x-order: 4
        type:
          description: the type of the property
          type: string
          x-order: 3
        value:
          description: the value of the property
          type: string
          x-order: 2
      required:
      - key
      - order
      - type
      - value
      type: object
    AuthPolicyDefinition:
      description: A single rule within an authentication policy, specifying access decisions for a token type.
      properties:
        authorizedPermissions:
          description: The set of permissions granted when this rule matches.
          items:
            type: string
          type: array
          x-order: 7
        decision:
          description: The access decision for matching tokens (e.g. 'allow', 'deny').
          type: string
          x-order: 1
        roleID:
          description: Role ID filter. When set, this rule only applies to tokens with this role.
          type: string
          x-order: 6
        rules:
          additionalProperties:
            type: object
          description: Additional rule conditions as key-value pairs.
          type: object
          x-order: 8
        runnerID:
          description: Runner ID filter. When set, this rule only applies to tokens for this deployment runner.
          type: string
          x-order: 5
        teamName:
          description: Team name filter. When set, this rule only applies to tokens belonging to this team.
          type: string
          x-order: 3
        tokenType:
          description: The type of token this rule applies to (e.g. 'personal', 'org', 'team').
          type: string
          x-order: 2
        userLogin:
          description: User login filter. When set, this rule only applies to tokens belonging to this user.
          type: string
          x-order: 4
      required:
      - authorizedPermissions
      - decision
      - rules
      - tokenType
      type: object