1. Docs
2. Reference
3. REST API Docs
4. Schema
5. OrganizationMetadata

OrganizationMetadata contains configuration, subscription, and feature information for an organization.

Properties

• id string required
  The unique identifier of the organization.
• kind enum required
  The kind of backing identity provider for the organization.
  Values:

  single-user — SingleUser

  OrganizationKindSingleUser is a Pulumi organization based around a single user.

  bitbucket — Bitbucket

  OrganizationKindBitbucket is a Pulumi organization based on a proper Bitbucket team.

  github — GitHub

  OrganizationKindGitHub is a Pulumi organization based on a proper GitHub organization.

  gitlab — GitLab

  OrganizationKindGitLab is a Pulumi organization based on a proper GitLab group.

  pulumi — Pulumi

  OrganizationKindPulumi is a Pulumi organization where membership is managed entirely by Pulumi.

  saml — SAML

  OrganizationKindSAML is a Pulumi organization based on a SAML SSO identity provider.

• created string required
  The time the organization was created.
• backingOrgLogin string optional
  The login name of the backing organization on the identity provider.
• product enum optional
  Subscription-related information if the organization has a Pulumi subscription. Otherwise, assume it is a grandfathered TeamPerStack org or in the Community Edition.
  Values:

  team-per-stack — TeamPerStack

  SaasOfferTeamPerStack Team Edition, billed per-stack.

  community — Community

  SaasOfferCommunity Community Edition.

  individual — Individual

  SaasOfferIndividual TBD individual edition.

  team-starter — TeamStarter

  SaasOfferTeamStarter Team Edition, billed per-member.

  team-pro — TeamPro

  SaasOfferTeamPro Team Edition, billed per-member.

  enterprise — Enterprise

  SaasOfferEnterprise Enterprise Edition, billed per-member.

  team-growth — TeamGrowth

  SaasOfferTeamGrowth acts like Team Starter, but is billed by consumption.

  enterprise-growth — EnterpriseGrowth

  SaasOfferEnterpriseGrowth acts like the Pulumi Enterprise edition, but is billed by consumption.

  business-critical — BusinessCritical

  SaasOfferBusinessCritical is the business critical edition, billed by consumption.

  free — Free

  The Pulumi Free tier for individual organizations with access to core features.

• subscriptionStatus string optional
  The Stripe subscription status (e.g. active, past_due, canceled), if applicable.
• subscriptionTrialEnd integer optional
  The Unix timestamp when the subscription trial ends.
• retrialExpiration string optional
  The time when the organization’s active retrial expires, if it is on a retrial.
• subscriptionCancelAtPeriodEnd boolean optional
  Whether the subscription will be canceled at the end of the current billing period.
• subscriptionPeriodEnd string optional
  The time when the current subscription or license period ends. For SaaS subscriptions this is the Stripe billing period end. For self-hosted installations this is the license expiry date.
• userRole enum required
  UserRole is the requesting user’s role in the organization.
  Values:

  none — None

  OrganizationRoleNone describes the role of non-members.

  member — Member

  OrganizationRoleMember is the role for regular members.

  admin — Admin

  OrganizationRoleAdmin is the role for admins.

  potential-member — PotentialMember

  OrganizationRolePotentialMember is the role for users who are explicitly not a member of the organization, but are a member of the backing org on the 3rd party identity provider. (i.e. they could join the org.)

  stack-collaborator — StackCollaborator

  OrganizationRoleStackCollaborator is the role for users who are not a member of an organization, but have been explicitly granted access to some of the organization’s stacks. So they have limited permissions to access the org’s data.

  billing-manager — BillingManager

  OrganizationRoleBillingManager is the role for billing admins.

• defaultStackPermission enum required
  DefaultStackPermission is the default permission every member has for accessing the organization’s stacks.
  Values:

  0 — None

  StackPermissionNone provides no access.

  101 — Read

  StackPermissionRead provides read-only access, including the ability to decrypt encrypted configuration secrets stored in the service.

  102 — Write

  StackPermissionWrite provides read/write access to a stack.

  103 — Admin

  StackPermissionAdmin provides admin-level access to the stack. For example, being able to run pulumi destroy or delete the stack.

  104 — Creator

  StackPermissionCreator identifies the user who created the stack. It confers the same access as StackPermissionAdmin.

• defaultEnvironmentPermission enum required
  DefaultEnvironmentPermission is the default permission every member has for accessing the organization’s environments.
  Values: none, read, open, write, admin
• defaultAccountPermission enum required
  DefaultAccountPermission is the default permission every member has for accessing the organization’s insight accounts.
  Values:

  0 — None

  InsightsAccountPermissionNone provides no access.

  1 — Read

  InsightsAccountPermissionRead provides read-only access.

  2 — Write

  InsightsAccountPermissionWrite provides read/write access to an account.

  3 — Admin

  InsightsAccountPermissionAdmin provides admin-level access to the account.

• membersCanCreateStacks boolean required
  Whether organization members can create stacks.
• membersCanDeleteStacks boolean required
  Whether organization members can delete stacks.
• membersCanTransferStacks boolean required
  Whether organization members can transfer stacks.
• membersCanCreateTeams boolean required
  Whether organization members can create teams.
• membersCanCreateAccounts boolean required
  Whether organization members can create Insights accounts.
• neoEnabled boolean required
  Whether Neo AI agent features are enabled for the organization.
• neoApprovalMode enum required
  neoApprovalMode is the default approval mode for new Neo AI agent tasks.
  Values: manual, auto, balanced
• neoTaskSharingMode enum required
  NeoTaskSharingMode is the task sharing mode for Neo AI agents in the organization.
  Values: none, org
• neoCLIExplanationsDisabled boolean required
  Whether Neo CLI explanations (preview and update-failure explanations served to the CLI) are disabled for the organization. Independent of neoEnabled; if neoEnabled is false, this flag has no additional effect.
• naturalLanguageSearchDisabled boolean required
  Whether natural-language resource search is disabled for the organization. Independent of neoEnabled; if neoEnabled is false, this flag has no additional effect.
• neoAgentDisabled boolean required
  Whether the Neo agent is disabled for the organization. Independent of neoEnabled; if neoEnabled is false, this flag has no additional effect.
• insightsTrialEnd integer optional
  The Unix timestamp when the Insights trial ends.
• insightsBillingAccepted boolean optional
  true if accepted, false if denied, nil if no action taken
• insightsTrialUsingPolicy boolean required
  true if org needs to be upgraded to business critical
• aiEnablement string required
  The AI feature enablement status for the organization (e.g. enabled, disabled, opt-in).
• preferredVCS enum required
  The organization’s preferred VCS vendor.
  Values:

  none — None

  bitbucket — Bitbucket

  github — GitHub

  gitlab — GitLab

• auditLogsEnabled boolean required
  Deprecated. Access the AuditLogsEnabled feature from the Features property.
• webhooksEnabled boolean required
  Deprecated. Access the WebhooksEnabled feature from the Features property.
• features OrganizationFeatures required
  The feature flags enabled for this organization, controlling access to specific functionality.
• ↳ auditLogsEnabled boolean required
  Whether audit logs are enabled for the organization.
• ↳ hasTerraformModules boolean optional
  Whether the organization has any Terraform modules in the registry. Data-driven (not plan-gated): drives the Terraform Modules console nav entry so customers can manage existing modules even on plans without publishing.
• ↳ crossGuardEnabled boolean required
  Whether CrossGuard policy enforcement is enabled.
• ↳ webhooksEnabled boolean required
  Whether webhooks are enabled for the organization.
• ↳ integrationAssistantEnabled boolean required
  Whether the integration assistant is enabled.
• ↳ aleEnabled boolean required
  Whether audit log export (ALE) is enabled.
• ↳ deployEnabled boolean required
  Whether Pulumi Deployments is enabled.
• ↳ scimEnabled boolean required
  Whether SCIM provisioning is enabled.
• ↳ resourceSearchEnabled boolean required
  Whether resource search is enabled.
• ↳ resourceExportEnabled boolean required
  Whether resource export is enabled.
• ↳ propertySearchUIEnabled boolean required
  Deprecated: property search is included with resource search for every organization, so this no longer gates any behavior.
• ↳ nlpSearchEnabled boolean required
  Whether natural language search is enabled.
• ↳ customTemplatesEnabled boolean required
  Whether custom templates are enabled.
• ↳ restoreStacksEnabled boolean required
  Whether restoring deleted stacks is enabled.
• ↳ environmentsEnabled boolean required
  Whether Pulumi ESC environments are enabled.
• ↳ environmentRevisionTagsEnabled boolean required
  Whether environment revision tags are enabled.
• ↳ legacyDeploymentsOrgToken boolean required
  Whether the organization uses a legacy org token for deployments.
• ↳ gitHubEnterpriseIntegrationEnabled boolean required
  Whether GitHub Enterprise integration is enabled.
• ↳ gitHubEnterpriseIndividualAuthEnabled boolean optional
  Deprecated. Per-user (individual) GitHub Enterprise authentication is now a per-installation setting; no longer populated.
• ↳ agentPoolRegistrationEnabled boolean required
  Whether agent pool registration is enabled for self-hosted deployments.
• ↳ dashboardOnboardingUIEnabled boolean optional
  Deprecated. The dashboard onboarding prompt UI has been removed; no longer populated (always false).
• ↳ driftDetectionEnabled boolean required
  Whether drift detection is enabled.
• ↳ selfHostedDeploymentsEnabled boolean required
  Whether self-hosted deployment agents are enabled.
• ↳ auditLogUIFilteringEnabled boolean required
  Whether audit log UI filtering is enabled.
• ↳ dependencyCachingEnabled boolean required
  Whether dependency caching for deployments is enabled.
• ↳ environmentsRestoreEnabled boolean required
  Whether restoring deleted environments is enabled.
• ↳ pangeaAccountsScanPageEnabled boolean required
  Whether the Pangea accounts scan page is enabled.
• ↳ customRolesEnabled boolean required
  Whether custom RBAC roles are enabled.
• ↳ usersCustomRolesEnabled boolean optional
  Whether assigning custom RBAC roles to individual users is enabled.
• ↳ environmentSecretRotationEnabled boolean required
  Whether environment secret rotation is enabled.
• ↳ insightsMonetizationEnabled boolean required
  Whether Insights monetization features are enabled.
• ↳ selfServeIDPRemoval boolean required
  Whether self-serve IDP removal is enabled.
• ↳ iacCloudImportEnabled boolean required
  Whether IaC cloud import is enabled.
• ↳ bringYourOwnKeyEnabled boolean required
  Whether bring-your-own-key encryption is enabled.
• ↳ approvalsEnabled boolean required
  Whether change request approvals are enabled.
• ↳ escOnboardingEnabled boolean required
  Whether ESC onboarding is enabled.
• ↳ escOnboardingV2Enabled boolean required
  Whether ESC onboarding v2 is enabled.
• ↳ escEditorRevampEnabled boolean optional
  Deprecated. Always true.
• ↳ escOnboardingAzureOAuthClientEnabled boolean required
  Whether the Azure OAuth client for ESC onboarding is enabled.
• ↳ escOnboardingGcpOAuthClientEnabled boolean required
  Whether the GCP OAuth client for ESC onboarding is enabled.
• ↳ policyManagementV2Enabled boolean required
  Whether policy management v2 is enabled.
• ↳ policyIssueManagementEnabled boolean required
  Whether policy issue management is enabled.
• ↳ aiAgentsEnabled boolean required
  Whether AI agents (Pulumi Copilot) are enabled.
• ↳ themingEnabled boolean required
  Whether UI theming is enabled.
• ↳ customRoleCondition boolean required
  Whether custom role conditions are enabled.
• ↳ neoTaskSharingEnabled boolean required
  Whether Copilot task sharing is enabled.
• ↳ ghAppDetailedDiffEnabled boolean required
  Whether the GitHub App detailed diff view is enabled.
• ↳ neoServerSideApprovalsEnabled boolean optional
  Deprecated. Always true.
• ↳ neoPlanModeEnabled boolean optional
  Deprecated. Always true.
• ↳ neoCustomRolesEnabled boolean required
  Whether starting Neo tasks with an assumed RBAC role is enabled.
• ↳ getStartedOnboardEnabled boolean optional
  Deprecated. The getting-started onboarding flow is enabled for everyone; no longer populated (always false).
• ↳ neoReadOnlyEnabled boolean optional
  Deprecated. Always true.
• ↳ discoveredStacksEnabled boolean required
  Whether discovered stacks are enabled.
• ↳ agentIntegrationCatalogEnabled boolean required
  Whether the agent integration catalog is enabled.
• ↳ agentScheduledTasksEnabled boolean required
  Whether agent automations are enabled.
• ↳ neoCustomAgentsEnabled boolean required
  Whether Custom Agents are enabled.
• ↳ neoSecurityEnabled boolean required
  Whether Neo Security (cloud security posture scanning) is enabled.
• ↳ aiReviewCodeAccessEnabled boolean optional
  Deprecated. The legacy per-stack code-access-for-AI-reviews setting has been removed; no longer populated (always false).
• ↳ neoCodeReviewsEnabled boolean optional
  Whether agentic Neo Code Reviews (a single agentic review per pull request, replacing the legacy per-stack AI preview summaries) are enabled.
• ↳ customVCSEnabled boolean required
  Whether custom VCS integrations are enabled.
• ↳ bitbucketVCSEnabled boolean required
  Whether Bitbucket VCS integration is enabled.
• ↳ insightsAutoPolicyPacksEnabled boolean required
  Whether the Insights auto policy packs experience (including the bulk account discover wizard) is enabled.
• ↳ fixDriftWithNeoEnabled boolean required
  Whether fixing drift with Neo is enabled.
• ↳ cliIntegrationCatalogEnabled boolean required
  Whether the CLI integration catalog is enabled.
• ↳ serviceBackedConfigEnabled boolean required
  Whether service-backed stack config is enabled.
• ↳ universalSearchEnabled boolean optional
  Whether universal search is enabled.
• ↳ driftRemediationEnabled boolean optional
  Whether drift remediation (auto-remediate via pulumi up –refresh) is enabled.
• ↳ expandedPolicyEnforcementLevelsEnabled boolean optional
  Whether expanded policy enforcement levels (including the Remediate level) are enabled.
• ↳ machineTokensEnabled boolean optional
  Whether machine tokens (organization access tokens) are enabled.
• ↳ samlSsoEnabled boolean optional
  Whether SAML SSO configuration is enabled.
• ↳ teamMemberRoleManagementEnabled boolean optional
  Whether team member role management (assigning custom roles per team member) is enabled.
• ↳ teamsEnabled boolean optional
  Whether team management (creating and assigning teams) is enabled.
• ↳ neoTokenMeteringEnabled boolean optional
  Deprecated. Matches aiAgentsEnabled.
• ↳ tagBasedDeploymentTriggersEnabled boolean optional
  Whether tag-based deployment triggers are enabled.
• ↳ notificationCenterEnabled boolean optional
  Whether the notification center (in-dashboard notification bell and inbox) is enabled.
• ↳ deploymentOidcSettingsEnabled boolean optional
  Whether the Deployments OIDC settings UI is shown.
• ↳ neoUsageLimitsEnabled boolean optional
  Whether org-configurable Neo usage limits (monthly dollar caps) are enabled.
• ↳ unlinkedGitHubAppRecoveryEnabled boolean optional
  Deprecated. Unlinked GitHub App installation recovery is now always enabled; no longer populated.
• ↳ accessTokenExpiryPolicyEnabled boolean optional
  Whether the per-org access token expiry policy (admin-configurable maximum lifetime for personal, organization, and team access tokens) is enabled.
• ↳ neoByokEnabled boolean required
  Whether Neo BYOK (bring-your-own-key) model provider configuration is enabled.
• ↳ neoAgentTaskRbacEnforcementEnabled boolean optional
  Whether the create-and-manage-Neo-tasks permission is enforced on Neo task creation for the organization (rollout flag). While unset the permission is evaluated in shadow mode only and denials do not block.
• ↳ linkExpressCheckoutEnabled boolean optional
  Whether one-click Link express checkout is enabled for adding a payment method.
• accountCount integer required
  AccountCount is the current number of Insights Accounts in the organization. (May be more than the requesting user has permission to see.)
• environmentCount integer required
  EnvironmentCount is the current number of environments in the organization. (May be more than the requesting user has permission to see.)
• stackCount integer required
  StackCount is the current number of stacks in the organization. (May be more than the requesting user has permission to see.)
• maxStacks integer optional
  MaxStacks is the maximum number of stacks the organization can have based on its subscription. Will be nil/omitted if there is no limit.
• memberCount integer required
  MemberCount is the number of members the organization has. Will be incorrect for organizations on the TeamPerStack subscription plan.
• maxMembers integer optional
  MaxMembers is the maximum number of members the organization can have based on its subscription. (Only set for per-member billed orgs.)
• locked enum optional
  Locked is non-nil if an organization is locked, indicating the specific reason why it was locked. (Which may determine which actions are available in the Console.)
  Values:

  bad-subscription — BadSubscription

  not-locked — NotLocked

  read-only — ReadOnly

  rename-in-progress — RenameInProgress

  transfer-in-progress — TransferInProgress

• defaultRoleId string optional
  DefaultRoleID is the ID of the default role for new users added to the organization. If unset, defaults to the “Member” role.
• defaultDeploymentRoleId string optional
  DefaultDeploymentRoleID is the ID of the default role used for deployments when no specific role is configured in the stack’s deployment settings. If unset, deployments run using the triggering user’s own permissions.
• pastDueSince string optional
  The time when the subscription entered past-due status, if applicable. Present only when the subscription is past due and the auto-lock grace period is active.
• maxAccessTokenExpiryDays integer optional
  The maximum allowed access token expiry, in days, for personal, organization, and team access tokens used against this organization. Null means no policy (the default behavior, in which tokens may have any expiry or no expiry). When set, requires every token to have an expiry, and the remaining lifetime of the token must not exceed this many days. Web sessions and system-managed tokens are not subject to this policy.