Every platform team fields the same questions: What is running? What breaks if we change this? What can we safely delete? The answers exist, but they’re scattered across state files, cloud consoles, and the memories of whoever set things up. Today we’re launching the Pulumi Context API, a read-only API that connects Pulumi-managed and discovered resources, stacks, and their relationships into a graph. It’s designed agent-first: Pulumi Neo, our infrastructure agent, uses it out of the box, and other agents can fetch the current graph vocabulary and query guidance on demand. It’s available in public preview for organizations on the Enterprise and Business Critical editions.
Answers that follow infrastructure relationships
Pulumi already records the resources your programs manage, their dependencies, how stacks consume each other’s outputs, and the resources Pulumi Discovery finds outside infrastructure as code (IaC). The Context API connects this data so you can ask questions that depend on the relationships:
- Impact: Which stacks are affected if we upgrade this provider? If this stack changes, what consumes its outputs?
- Coverage: How much of our infrastructure lives outside IaC, and in which accounts?
- Cleanup: Which stacks have no dependents and are candidates for retirement?
A query is a JSON document with a handful of clauses. anchor names the starting nodes, traverse follows relationships from there, and return chooses what comes back. You can run a query through the Pulumi CLI or REST API. Here’s a selector that starts from AWS provider instances older than version 7.0.0 and follows incoming provided_by relationships back to the visible resources they manage:
{
"anchor": {
"nodeType": "resource",
"match": {
"type": "pulumi:providers:aws",
"fields": { "provider_version": { "op": "lt", "value": "7.0.0" } }
}
},
"traverse": [
{
"edgeTypes": ["provided_by"],
"direction": "in",
"alias": "managed"
}
],
"return": { "select": ["anchor", "managed"] }
}
A response for one matching provider and one managed resource looks like this (abridged for clarity):
{
"nodes": [
{
"id": "urn:pulumi:prod::payments::pulumi:providers:aws::default_6_0_4",
"nodeType": "resource",
"frontier": ["anchor"],
"type": "pulumi:providers:aws"
},
{
"id": "urn:pulumi:prod::payments::aws:ec2/instance:Instance::payments-web-0",
"nodeType": "resource",
"frontier": ["managed"],
"type": "aws:ec2/instance:Instance"
}
],
"edges": [
{
"from": "urn:pulumi:prod::payments::aws:ec2/instance:Instance::payments-web-0",
"to": "urn:pulumi:prod::payments::pulumi:providers:aws::default_6_0_4",
"type": "provided_by"
}
],
"pageInfo": { "resultCount": 2 },
"meta": {
"resultMode": "exact",
"visibility": "complete"
}
}
The anchor frontier marks the provider, while managed marks the EC2 instance reached by the traversal. The provided_by edge keeps its defined direction from the instance to its provider, and resultCount reflects the two nodes on this page. The Context API query guide walks through the complete response, and its completeness guidance explains how to assess an answer before acting on it.
Ask Neo or bring your own agent
Start by asking an agent a question in natural language. Pulumi Neo uses the Context API out of the box and runs queries with the permissions of the person who invoked it.
Claude Code, Cursor, Codex, and other agents that can run authenticated Pulumi CLI commands can fetch the schema endpoint’s Markdown primer:
pulumi api GetGraphQuerySchema
The primer explains the current graph vocabulary, query grammar, engine limits, examples, pagination, and completeness checks. Put the command in your AGENTS.md or CLAUDE.md so the agent can refresh the primer as the API evolves. The human-readable query guide explains the same concepts and includes direct CLI and REST examples.
Available in public preview
The Context API is available now for every organization on the Enterprise and Business Critical editions. The pulumi api access requirements include Pulumi CLI v3.243.0 or later, an authenticated session, and a role with the resources:search permission. The default Member and Admin roles grant this permission. Pulumi Cloud role-based access control limits responses to the resources, stacks, and cloud accounts the caller can read.
During public preview, the graph vocabulary and limits may change. Fetch the deployed schema when you need the current contract. We also plan to connect more Pulumi Cloud data, including Pulumi ESC environments, teams and roles, cloud accounts, and service catalog concepts from Pulumi IDP. Feedback during preview will shape the relationships and data sources we add next.
Get started
Start with the Context API overview, then follow the agent workflow to equip your agent. Ask a natural-language question such as, “Which stacks consume outputs from the payments/prod stack?”
Give it a try today, and share your feedback in the Pulumi Community Slack or through your account team.
