organization %q at host %s not found. Please ensure that th

Error message

organization %q at host %s not found.

Please ensure that the organization and hostname are correct and that your API token for %s is valid.

What it means

Returned by Remote.Configure when the TFE Organizations.ReadEntitlements call fails with tfe.ErrResourceNotFound, meaning the configured organization does not exist at the given hostname (or the token cannot see it). The message is user-facing and instructs verifying both the organization name and the API token validity.

Source

Thrown at internal/backend/remote/backend.go:361

	// Create the remote backend API client.
	b.client, err = tfe.NewClient(cfg)
	if err != nil {
		diags = diags.Append(tfdiags.Sourceless(
			tfdiags.Error,
			"Failed to create the Terraform Enterprise client",
			fmt.Sprintf(
				`The "remote" backend encountered an unexpected error while creating the `+
					`Terraform Enterprise client: %s.`, err,
			),
		))
		return diags
	}

	// Check if the organization exists by reading its entitlements.
	entitlements, err := b.client.Organizations.ReadEntitlements(context.Background(), b.organization)
	if err != nil {
		if err == tfe.ErrResourceNotFound {
			err = fmt.Errorf("organization %q at host %s not found.\n\n"+
				"Please ensure that the organization and hostname are correct "+
				"and that your API token for %s is valid.",
				b.organization, b.hostname, b.hostname)
		}
		diags = diags.Append(tfdiags.AttributeValue(
			tfdiags.Error,
			fmt.Sprintf("Failed to read organization %q at host %s", b.organization, b.hostname),
			fmt.Sprintf("The \"remote\" backend encountered an unexpected error while reading the "+
				"organization settings: %s", err),
			cty.Path{cty.GetAttrStep{Name: "organization"}},
		))
		return diags
	}

	// Configure a local backend for when we need to run operations locally.
	b.local = backendLocal.NewWithBackend(b)
	b.forceLocal = b.forceLocal || !entitlements.Operations

View on GitHub (pinned to c9def3e214)

Solutions

Verify the 'organization' attribute exactly matches the TFC/TFE org name (case-sensitive).
Confirm the token is for the same hostname and has access to that org: curl -H "Authorization: Bearer <token>" https://<host>/api/v2/organizations.
If the org was renamed, update the backend block.
Re-run 'terraform login <hostname>' if the token may have expired.

Example fix

# before
terraform {
  backend "remote" {
    hostname     = "app.terraform.io"
    organization = "MyOrg"   # wrong case / renamed
  }
}
# after
terraform {
  backend "remote" {
    hostname     = "app.terraform.io"
    organization = "my-org"  # exact slug
  }
}

Defensive patterns

Strategy: validation

Validate before calling

// Pre-flight: verify the org is reachable with the configured token
import "github.com/hashicorp/go-tfe"

func orgAccessible(ctx context.Context, host, token, org string) error {
  c, err := tfe.NewClient(&tfe.Config{Address: "https://"+host, Token: token})
  if err != nil { return err }
  if _, err := c.Organizations.Read(ctx, org); err != nil {
    return fmt.Errorf("org %q unreachable on %s with this token: %w", org, host, err)
  }
  return nil
}

Try / catch

// Configure surfaces this via tfdiags; in custom code, branch on ErrResourceNotFound
diags := b.Configure(obj)
for _, d := range diags {
    if strings.Contains(d.Description().Summary, "not found") {
        // prompt for correct org name or re-login
    }
}

Prevention

Validate the organization slug and token with a Read call before Configure.
Re-run 'terraform login <hostname>' when tokens may have expired.
Lock the org name in a shared variable to avoid typos.
Confirm the token's scope covers the target org in TFC/TFE UI.

When it happens

Trigger: Configure() runs after service discovery + token retrieval, then calls Organizations.ReadEntitlements(b.organization); a 404 response maps to ErrResourceNotFound and is rewritten into this guidance message.

Common situations: Typo in the 'organization' attribute; organization renamed/deleted on Terraform Cloud/Enterprise; API token belongs to a different org or lacks access; token expired or revoked; wrong hostname (pointing at an instance without that org).

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/8bf5c8e5f31bc4fe. Report an issue: GitHub.