Skip to main content
Pulumi logo Pulumi logo
25.4K Contact us Sign in Dashboard Get started
  1. Docs
  2. Reference
  3. REST API Docs
  4. Cloud Setup

Cloud Setup

    The Cloud Setup API helps you configure cloud provider credentials and integrations for use with Pulumi. Endpoints cover initial provider setup workflows for AWS, Azure, and GCP.

    AWS Setup

    ▼
    POST /api/esc/cloudsetup/{orgName}/aws/setup

    Sets up AWS infrastructure using provided static credentials

    Request Parameters

    • orgName string path required
      The organization name

    Request Body

    Schema: AWSSetupRequest
    • accessKeyId string required
      AWS Access Key ID
    • secretAccessKey string required
      AWS Secret Access Key
    • sessionToken string required
      AWS Session Token (for temporary credentials)
    • policyArn string required
      ARN of the IAM policy to attach to the role
    • oidcRoleName string required
      Name of IAM Role for OIDC

    Responses

    200 OK
    Schema: CloudSetupResult
    • success boolean required
      Whether the setup operation was successful
    • resources array[CloudSetupResource] required
      List of resources created or managed during setup
    • ↳ type string required
      Type of the resource
    • ↳ id string required
      Unique identifier of the resource
    • ↳ name string required
      Name of the resource
    • ↳ status string required
      Status of the resource operation
    • ↳ error string optional
      Error message if the resource operation failed
    • ↳ properties map[string]string optional
      Additional properties of the resource
    • message string optional
      Optional message about the setup operation
    Errors: 400 Failed to setup infrastructure

    AWSSSO List Accounts

    ▼
    GET /api/esc/cloudsetup/{orgName}/aws/sso/accounts

    Lists AWS accounts accessible with the provided session

    Request Parameters

    • orgName string path required
      The organization name
    • region string query optional
      The AWS region
    • sessionId string query optional
      The SSO session identifier

    Responses

    200 OK
    Schema: ListCloudAccountsResponse
    • accounts array[CloudAccount] required
      List of cloud accounts/subscriptions
    • ↳ id string required
      Account/subscription ID
    • ↳ name string required
      Account/subscription name
    • ↳ roles array[string] optional
      Roles
    • ↳ number integer optional
      Project number (for Azure)
    Errors: 400 Failed to list accounts 404 Organization or Session not found 412 Session not yet authorized

    AWSSSO Initiate

    ▼
    POST /api/esc/cloudsetup/{orgName}/aws/sso/initiate

    Initiates the AWS SSO flow

    Request Parameters

    • orgName string path required
      The organization name

    Request Body

    Schema: AWSSSOInitiateRequest
    • startUrl string required
      The AWS SSO Start URL
    • region string required
      The AWS SSO Region

    Responses

    200 OK
    Schema: AWSSSOInitiateResponse
    • url string required
      The AWS SSO Verification URL
    • userCode string required
      The AWS SSO User Code to verify
    • sessionId string required
      The auth session id
    Errors: 400 Failed to initiate AWS SSO flow

    AWSSSO Setup

    ▼
    POST /api/esc/cloudsetup/{orgName}/aws/sso/setup

    Sets up AWS infrastructure and ESC environments using AWS SSO

    Request Parameters

    • orgName string path required
      The organization name

    Request Body

    Schema: AWSSSOSetupRequest
    • sessionId string required
      The auth session id
    • region string required
      The AWS SSO Region
    • accountId string required
      The AWS account id
    • accountRoleName string required
      The AWS account role name
    • policyArn string required
      ARN of the IAM policy to attach to the role
    • oidcRoleName string required
      Name of IAM Role for OIDC

    Responses

    200 OK
    Schema: CloudSetupResult
    • success boolean required
      Whether the setup operation was successful
    • resources array[CloudSetupResource] required
      List of resources created or managed during setup
    • ↳ type string required
      Type of the resource
    • ↳ id string required
      Unique identifier of the resource
    • ↳ name string required
      Name of the resource
    • ↳ status string required
      Status of the resource operation
    • ↳ error string optional
      Error message if the resource operation failed
    • ↳ properties map[string]string optional
      Additional properties of the resource
    • message string optional
      Optional message about the setup operation
    Errors: 400 Failed to setup infrastructure 404 Organization or Session not found

    Azure List Accounts

    ▼
    GET /api/esc/cloudsetup/{orgName}/oauth/azure/accounts

    Lists Azure subscriptions accessible with the provided ARM session

    Request Parameters

    • orgName string path required
      The organization name
    • armSessionId string query optional
      The Azure ARM session identifier

    Responses

    200 OK
    Schema: ListCloudAccountsResponse
    • accounts array[CloudAccount] required
      List of cloud accounts/subscriptions
    • ↳ id string required
      Account/subscription ID
    • ↳ name string required
      Account/subscription name
    • ↳ roles array[string] optional
      Roles
    • ↳ number integer optional
      Project number (for Azure)
    Errors: 400 Failed to list azure subscriptions 404 Organization or Session not found

    Azure Setup

    ▼
    POST /api/esc/cloudsetup/{orgName}/oauth/azure/setup

    Sets up Azure infrastructure and ESC environments using OAuth credentials

    Request Parameters

    • orgName string path required
      The organization name

    Request Body

    Schema: AzureSetupRequest
    • armSessionId string required
      ARM (Azure Resource Manager) OAuth session ID
    • graphSessionId string required
      Microsoft Graph OAuth session ID
    • azureEnvironmentInfos array[AzureEnvironmentInfo] required
      List of Azure environment configurations to create
    • appObjectId string optional
      Object ID of the app registration created by a prior AzureSetup call. When set, the app registration is resolved by ID instead of searched by display name, so batched setup calls cannot land on different app registrations.
    • servicePrincipalId string optional
      Object ID of the service principal created by a prior AzureSetup call. When set, the service principal lookup is skipped and roles are assigned to this principal.

    Responses

    200 OK
    Schema: CloudSetupResult
    • success boolean required
      Whether the setup operation was successful
    • resources array[CloudSetupResource] required
      List of resources created or managed during setup
    • ↳ type string required
      Type of the resource
    • ↳ id string required
      Unique identifier of the resource
    • ↳ name string required
      Name of the resource
    • ↳ status string required
      Status of the resource operation
    • ↳ error string optional
      Error message if the resource operation failed
    • ↳ properties map[string]string optional
      Additional properties of the resource
    • message string optional
      Optional message about the setup operation
    Errors: 400 Failed to setup infrastructure 404 Organization or Session not found

    Complete O Auth

    ▼
    POST /api/esc/cloudsetup/{orgName}/oauth/complete

    Completes OAuth flow by exchanging authorization code for access token

    Request Parameters

    • orgName string path required
      The organization name

    Request Body

    Schema: CompleteOAuthRequest
    • provider CloudSetupProvider required
      CloudSetupProvider configuration for OAuth authentication
    • sessionID string required
      Session identifier from OAuth initiation
    • code string required
      Authorization code returned from OAuth provider

    Responses

    200 OK
    Schema: CompleteOAuthResponse
    Errors: 400 Failed to complete OAuth

    GCP List Accounts

    ▼
    GET /api/esc/cloudsetup/{orgName}/oauth/gcp/accounts

    Lists GCP projects accessible with the provided OAuth session. When ‘gcpOrganizationId’ is provided, discovery is scoped to that GCP organization: results include projects directly under the organization and projects nested under its descendant folders, and a 400 is returned if the ID is malformed or returned no projects. When ‘gcpOrganizationId’ is omitted, all active projects the OAuth principal can access are returned regardless of organization. System-generated projects (IDs prefixed ‘sys-’) and projects pending deletion are excluded in both cases.

    Request Parameters

    • orgName string path required
      The organization name
    • gcpOrganizationId string query optional
      Optional GCP numeric organization ID. When provided, results are scoped to projects directly under this organization and projects nested under its descendant folders; when omitted, all accessible projects are returned. Find it in the Google Cloud console under IAM & Admin > Settings.
    • oauthSessionId string query optional
      The OAuth session identifier. Required; returns 400 when missing.

    Responses

    200 OK
    Schema: ListCloudAccountsResponse
    • accounts array[CloudAccount] required
      List of cloud accounts/subscriptions
    • ↳ id string required
      Account/subscription ID
    • ↳ name string required
      Account/subscription name
    • ↳ roles array[string] optional
      Roles
    • ↳ number integer optional
      Project number (for Azure)
    Errors: 400 Failed to list gcp projects, or 'gcpOrganizationId' is malformed or returned no projects 404 Organization or Session not found

    GCP Setup

    ▼
    POST /api/esc/cloudsetup/{orgName}/oauth/gcp/setup

    Sets up GCP infrastructure using OAuth credentials

    Request Parameters

    • orgName string path required
      The organization name

    Request Body

    Schema: GCPSetupRequest
    • oauthSessionId string required
      GCP OAuth session ID
    • gcpEnvironmentInfo GCPEnvironmentInfo required
      GCP environment configuration to create

    Responses

    200 OK
    Schema: CloudSetupResult
    • success boolean required
      Whether the setup operation was successful
    • resources array[CloudSetupResource] required
      List of resources created or managed during setup
    • ↳ type string required
      Type of the resource
    • ↳ id string required
      Unique identifier of the resource
    • ↳ name string required
      Name of the resource
    • ↳ status string required
      Status of the resource operation
    • ↳ error string optional
      Error message if the resource operation failed
    • ↳ properties map[string]string optional
      Additional properties of the resource
    • message string optional
      Optional message about the setup operation
    Errors: 400 Failed to setup infrastructure 404 Organization or Session not found

    Initiate O Auth

    ▼
    POST /api/esc/cloudsetup/{orgName}/oauth/initiate

    Initiates OAuth flow for a given cloud provider

    Request Parameters

    • orgName string path required
      The organization name

    Request Body

    Schema: InitiateOAuthRequest
    • provider CloudSetupProvider required
      CloudSetupProvider configuration for OAuth authentication

    Responses

    200 OK
    Schema: InitiateOAuthResponse
    • url string required
      Authorization URL to redirect user to
    • sessionID string required
      Session identifier for tracking the OAuth flow
    Errors: 400 Failed to initiate oauth

      The infrastructure as code platform for any cloud.

      Contact us Get started