pulumi/pulumi · error

exporting audit logs: %w

Error message

exporting audit logs: %w

What it means

This error is returned by Client.ExportAuditLogs when the GET /api/orgs/{orgName}/auditlogs/export REST call fails. On success the server returns a streaming body (io.ReadCloser); this error wraps any failure before or during establishing that export, preserving the underlying restCall error via %w.

Source

Thrown at pkg/backend/httpstate/client/client.go:1796

	}
	queryObj := struct {
		Format            string `url:"format,omitempty"`
		EventType         string `url:"eventType,omitempty"`
		User              string `url:"user,omitempty"`
		StartTime         string `url:"startTime,omitempty"`
		ContinuationToken string `url:"continuationToken,omitempty"`
	}{
		Format:            format,
		EventType:         opts.EventType,
		User:              opts.User,
		StartTime:         opts.StartTime,
		ContinuationToken: opts.ContinuationToken,
	}

	var body io.ReadCloser
	path := fmt.Sprintf("/api/orgs/%s/auditlogs/export", url.PathEscape(orgName))
	if err := pc.restCall(ctx, http.MethodGet, path, queryObj, nil, &body); err != nil {
		return nil, fmt.Errorf("exporting audit logs: %w", err)
	}
	return body, nil
}

// UpdateOrganizationMember updates the role assignment of a member within
// the given organization. Wraps the `UpdateOrganizationMember` Pulumi Cloud
// REST endpoint (PATCH /api/orgs/{orgName}/members/{userLogin}). Only the
// non-nil fields of req are sent; the service interprets omitted fields as
// "leave unchanged".
func (pc *Client) UpdateOrganizationMember(
	ctx context.Context, orgName, userLogin string, req apitype.UpdateOrganizationMemberRequest,
) error {
	path := fmt.Sprintf("/api/orgs/%s/members/%s", url.PathEscape(orgName), url.PathEscape(userLogin))
	if err := pc.restCall(ctx, http.MethodPatch, path, nil, req, nil); err != nil {
		return fmt.Errorf("updating organization member: %w", err)
	}
	return nil
}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Verify the token's role can export audit logs (Admin/audit permissions on the organization).
2. Validate the org slug and the date range/ContinuationToken fields in ExportAuditLogsOptions.
3. Retry transient failures with backoff; for large ranges, narrow the export window.
4. Unwrap the error to inspect the HTTP status returned by the service.

Example fix

// before
body, err := client.ExportAuditLogs(ctx, orgName, opts)
if err != nil { return err }
// after
body, err := client.ExportAuditLogs(ctx, orgName, opts)
if err != nil {
    return fmt.Errorf("cannot export audit logs for %q: %w", orgName, err)
}
defer body.Close()

if orgName == "" {
    return errors.New("organization name is required")
}
if os.Getenv("PULUMI_ACCESS_TOKEN") == "" {
    return errors.New("PULUMI_ACCESS_TOKEN is not set")
}

func isPermissionErr(err error) bool {
    var restErr *apitype.ErrorResponse
    return errors.As(err, &restErr) && restErr.Code == http.StatusForbidden
}

var body io.ReadCloser
var err error
for attempt := 0; attempt < 3; attempt++ {
    body, err = client.ExportAuditLogs(ctx, orgName, opts)
    if err == nil {
        break
    }
    var restErr *apitype.ErrorResponse
    if errors.As(err, &restErr) && restErr.Code < 500 {
        break // client error: do not retry
    }
    time.Sleep(time.Duration(1<<attempt) * time.Second)
}
if err != nil {
    return fmt.Errorf("exporting audit logs for %q: %w", orgName, err)
}
defer body.Close()

When it happens

Trigger: Calling ExportAuditLogs(ctx, orgName, opts) when the export request fails: missing audit-log permissions (403), invalid token (401), unknown org (404), invalid date range or continuation token, or network failure before the response body is opened.

Common situations: Compliance automation exporting audit logs with a token whose role lacks audit access; very large exports timing out at the proxy; org slug mismatch after a rename.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• listing audit logs: %w
• reading response from API: %w
• creating agent Pulumi account: signup response did not inclu
• removing policy group: %w
• listing organization members: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/47c10ba8a8a5365b. Report an issue: GitHub.