What causes "approved using the UI or API" in hashicorp/terraform?

No fix needed — this is informational; the apply continues normally because the run was approved externally.

errRunApproved

errRunApproved

Error message

approved using the UI or API

What it means

A sentinel error used internally by the cloud backend to signal that a run was approved externally (via TFC/TFE UI or API) while the CLI was waiting for local interactive confirmation. In backend_common.go:478-479 it is set when the run's Actions.IsConfirmable becomes false and status is not RunDiscarded. Crucially, this error is NOT fatal — backend_apply.go:170 and :187 explicitly check 'err != errRunApproved' to allow the apply to proceed when the run was confirmed out-of-band.

Source

Thrown at internal/cloud/errors.go:19

// Copyright IBM Corp. 2014, 2026
// SPDX-License-Identifier: BUSL-1.1

package cloud

import (
	"errors"
	"fmt"
	"strings"

	"github.com/hashicorp/terraform/internal/tfdiags"
	"github.com/zclconf/go-cty/cty"
)

// String based errors
var (
	errApplyDiscarded                    = errors.New("Apply discarded.")
	errDestroyDiscarded                  = errors.New("Destroy discarded.")
	errRunApproved                       = errors.New("approved using the UI or API")
	errRunDiscarded                      = errors.New("discarded using the UI or API")
	errRunOverridden                     = errors.New("overridden using the UI or API")
	errApplyNeedsUIConfirmation          = errors.New("Cannot confirm apply due to -input=false. Please handle run confirmation in the UI.")
	errPolicyOverrideNeedsUIConfirmation = errors.New("Cannot override soft failed policy checks when -input=false. Please open the run in the UI to override.")
)

// Diagnostic error messages
var (
	invalidWorkspaceConfigMissingValues = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",
		fmt.Sprintf("Missing workspace mapping strategy. Either workspace \"tags\" or \"name\" is required.\n\n%s", workspaceConfigurationHelp),
		cty.Path{cty.GetAttrStep{Name: "workspaces"}},
	)

	invalidWorkspaceConfigMisconfiguration = tfdiags.AttributeValue(
		tfdiags.Error,
		"Invalid workspaces configuration",

View on GitHub (pinned to d32a084675)

Solutions

No fix needed — this is informational; the apply continues normally because the run was approved externally.
If you want to prevent external approvals during CLI sessions, use workspace locks or coordinate approval timing.
If you prefer CLI-only confirmation, avoid approving runs in the UI while a CLI apply is in progress.

Defensive patterns

Strategy: try-catch

Try / catch

// This error is non-fatal — the cloud backend already handles it internally.
// If wrapping terraform, check for it and treat as success:
// if errors.Is(err, cloud.ErrRunApproved) { /* run approved externally, proceed */ }

Prevention

Do not treat this as an error in automation — it means the run succeeded via external approval.
Use workspace locks if you need strict serialization of approval actions.
Document team workflows for who approves runs (UI vs CLI) to avoid confusion.

When it happens

Trigger: During 'terraform apply' with a cloud backend, while the CLI shows the confirmation prompt, someone clicks 'Confirm & Apply' in the Terraform Cloud UI or approves via API. The polling goroutine detects Actions.IsConfirmable == false and returns errRunApproved instead of waiting for local input.

Common situations: A team lead approves a run in the TFC UI while the developer who ran 'terraform apply' is still reviewing the plan locally; an automation system approves via API while a human-initiated CLI apply is in progress.

Related errors

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/326253f0159a196e. Report an issue: GitHub.