{"record":{"id":"9213e71ae39339f2","repo":"hashicorp/terraform","slug":"could-not-read-state-version-output-s-w","errorCode":null,"errorMessage":"could not read state version output %s: %w","messagePattern":"could not read state version output (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloud/state.go","lineNumber":605,"sourceCode":"\t\t\t}\n\n\t\t\tstate := s.State()\n\t\t\tif state == nil {\n\t\t\t\t// We know that there is supposed to be state (and this is not simply a new workspace\n\t\t\t\t// without state) because the fallback is only invoked when outputs are present but\n\t\t\t\t// detailed types are not available.\n\t\t\t\treturn nil, ErrStateVersionUnauthorizedUpgradeState\n\t\t\t}\n\n\t\t\treturn state.RootOutputValues, nil\n\t\t}\n\n\t\tif output.Sensitive {\n\t\t\t// Since this is a sensitive value, the output must be requested explicitly in order to\n\t\t\t// read its value, which is assumed to be present by callers\n\t\t\tsensitiveOutput, err := s.tfeClient.StateVersionOutputs.Read(ctx, output.ID)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"could not read state version output %s: %w\", output.ID, err)\n\t\t\t}\n\t\t\toutput.Value = sensitiveOutput.Value\n\t\t}\n\n\t\tcval, err := tfeOutputToCtyValue(*output)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not decode output %s (ID %s)\", output.Name, output.ID)\n\t\t}\n\n\t\tresult[output.Name] = &states.OutputValue{\n\t\t\tValue:     cval,\n\t\t\tSensitive: output.Sensitive,\n\t\t}\n\t}\n\n\treturn result, nil\n}\n","sourceCodeStart":587,"sourceCodeEnd":623,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/cloud/state.go#L587-L623","documentation":"For each sensitive output Terraform must do an explicit StateVersionOutputs.Read(output.ID) to fetch the actual value. This wraps a failure of that per-output read for a sensitive output.","triggerScenarios":"Reading a workspace whose outputs include sensitive values, and the explicit read of one output's value fails (auth, network, or the output was removed concurrently).","commonSituations":"Token lacks permission to read sensitive output values, a network blip on a specific output request, or the output was deleted between listing and reading.","solutions":["Ensure the token can read sensitive output values.","Retry on a transient network error.","Confirm the output still exists in the latest state version."],"exampleFix":"# before: token cannot read sensitive outputs -> could not read state version output <id>\n# after: grant sensitive-output read scope / re-login, then retry\nterraform login app.terraform.io\nterraform output sensitive_value","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"outs, err := state.GetRootOutputValues(ctx)\nif err != nil && strings.Contains(err.Error(), \"could not read state version output\") {\n    if isTransientHTTP(err) {\n        // bounded retry of GetRootOutputValues\n    }\n}","preventionTips":["Ensure the token can read sensitive output values","Retry transient per-output read failures","Confirm the output still exists in the latest state version"],"tags":["outputs","sensitive","retrieval","auth"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}