hashicorp/terraform · error

organization %q at host %s not found. Please ensure that th

Error message

organization %q at host %s not found.

Please ensure that the organization and hostname are correct and that your API token for %s is valid.

What it means

Returned in backend Configure at backend.go:371 when b.client.Organizations.ReadEntitlements returns tfe.ErrResourceNotFound during the org existence check. Because the API returns 404 both when the org truly does not exist AND when the token lacks access, the message instructs the user to verify both the org/hostname and the token validity.

Source

Thrown at internal/cloud/backend.go:371

						`HCP Terraform or Terraform Enterprise client: %s.`, err,
				),
			))
			return diags
		}
	}

	// Read the app name header and if empty, provide a default
	b.appName = b.client.AppName()
	// Validate the header's value to ensure no tampering
	if !isValidAppName(b.appName) {
		b.appName = "HCP Terraform"
	}

	// Check if the organization exists by reading its entitlements.
	entitlements, err := b.client.Organizations.ReadEntitlements(context.Background(), b.Organization)
	if err != nil {
		if err == tfe.ErrResourceNotFound {
			err = fmt.Errorf("organization %q at host %s not found.\n\n"+
				"Please ensure that the organization and hostname are correct "+
				"and that your API token for %s is valid.",
				b.Organization, b.Hostname, b.Hostname)
		}
		diags = diags.Append(tfdiags.AttributeValue(
			tfdiags.Error,
			fmt.Sprintf("Failed to read organization %q at host %s", b.Organization, b.Hostname),
			fmt.Sprintf("Encountered an unexpected error while reading the "+
				"organization settings: %s", err),
			cty.Path{cty.GetAttrStep{Name: "organization"}},
		))
		return diags
	}

	// If TF_WORKSPACE specifies a current workspace to use, make sure it's usable.
	if ws, ok := os.LookupEnv("TF_WORKSPACE"); ok {
		if ws == b.WorkspaceMapping.Name || b.WorkspaceMapping.IsTagsStrategy() {
			diag := b.validWorkspaceEnvVar(context.Background(), b.Organization, ws)

View on GitHub (pinned to c9def3e214)

Solutions

1. Confirm the organization slug in the cloud block matches the HCP/TFE UI exactly (case-sensitive).
2. Re-authenticate: terraform login <hostname> to refresh/replace the token.
3. Verify the token's user is a member of the target organization.
4. Double-check the hostname points to the right installation.

Example fix

// before: token for wrong org / typo
terraform { cloud { organization = "Aceme" hostname = "app.terraform.io" } }

// after
terraform { cloud { organization = "acme" hostname = "app.terraform.io" } }
# then: terraform login app.terraform.io

// Check the org slug and token validity before Configure.
if b.Organization == "" { return errors.New("organization required") }
if _, err := tfe.NewClient(&tfe.Config{Token: token, Address: host}); err != nil {
    return err
}

if errors.Is(err, tfe.ErrResourceNotFound) { /* org missing or token lacks access */ }

// Map the 404 into a clear auth/config diagnostic.
if errors.Is(err, tfe.ErrResourceNotFound) {
    return fmt.Errorf("organization %q at host %s not found; check name and token", org, host)
}

When it happens

Trigger: terraform init with a cloud {} block after token setup; the entitlements read for b.Organization on b.Hostname returns HTTP 404.

Common situations: Organization name typo in the cloud block; correct org but the API token belongs to a different org or has no membership; TFE token expired or revoked; hostname points at the right server but wrong org slug.

Related errors

• workspace %s not found For security, %s returns '404 Not Fo
• %s returned an unexpected error: %s
• your version of Terraform Enterprise does not support key-va
• operation timed out
• {joined API error payload}

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/9470c42dc67cda17. Report an issue: GitHub.