What causes "approved using the UI or API" in hashicorp/terraform?

No action needed — the apply will continue against the already-approved run.

hashicorp/terraform · info · errRunApproved

approved using the UI or API

Error message

approved using the UI or API

What it means

errRunApproved is a sentinel indicating the run was approved externally (via the HCP Terraform/TFE UI or API) while the CLI confirm() goroutine was waiting for interactive input. It is not a failure: backend_apply.go:170 explicitly excludes it from the error path (err != errRunApproved) so the apply proceeds. It exists so the CLI knows the approval happened out-of-band and should not double-submit.

Source

Thrown at internal/cloud/errors.go:19

// Copyright IBM Corp. 2014, 2026
// SPDX-License-Identifier: BUSL-1.1

package cloud

import (
	"errors"
	"fmt"
	"strings"

	"github.com/hashicorp/terraform/internal/tfdiags"
	"github.com/zclconf/go-cty/cty"
)

// String based errors
var (
	errApplyDiscarded                    = errors.New("Apply discarded.")
	errDestroyDiscarded                  = errors.New("Destroy discarded.")
	errRunApproved                       = errors.New("approved using the UI or API")
	errRunDiscarded                      = errors.New("discarded using the UI or API")
	errRunOverridden                     = errors.New("overridden using the UI or API")
	errApplyNeedsUIConfirmation          = errors.New("Cannot confirm apply due to -input=false. Please handle run confirmation in the UI.")
	errPolicyOverrideNeedsUIConfirmation = errors.New("Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.")
)

// Diagnostic error messages
var (
	invalidWorkspaceConfigMissingValues = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Missing workspace mapping strategy. Either workspace \"tags\" or \"name\" is required.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},
	)

	invalidWorkspaceConfigMisconfiguration = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",

View on GitHub (pinned to c9def3e214)

Solutions

No action needed — the apply will continue against the already-approved run.
If unexpected, review the run's activity log in the UI to see who/what approved it.

Defensive patterns

Strategy: try-catch

Try / catch

// errRunApproved is informational: the apply proceeds, do not treat as error.
err := b.confirm(ctx, op, opts, run, "yes")
if errors.Is(err, cloud.ErrRunApproved) || strings.Contains(err.Error(), "approved using the UI or API") {
    // externally approved; continue normally
    return nil
}
if err != nil {
    return err
}

Prevention

Document that out-of-band UI/API approval is valid and will not block the CLI.
Avoid double-approving: if you approve via API, cancel the CLI prompt to avoid races.
Log which path approved the run for auditability.

When it happens

Trigger: In Cloud.confirm (backend_common.go:479) for the 'yes' keyword: when the polled run's Actions.IsConfirmable becomes false and Status is not Discarded, the goroutine returns errRunApproved. The caller then skips its own Runs.Apply call.

Common situations: An operator confirms the run in the HCP Terraform web UI before the CLI user types 'yes'; CI approved the run via API while a developer held the prompt open.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/3bb20a60d20caced. Report an issue: GitHub.