pulumi/pulumi · error

List Policy Groups failed: %w

Error message

List Policy Groups failed: %w

What it means

ListPolicyGroups issues GET against the policy groups endpoint for an organization and wraps any transport or API error as 'List Policy Groups failed: %w'. The note in the source records that this API is not paginated, so the only failure modes are HTTP/decoding errors from restCall (auth, permissions, unknown org, network).

Source

Thrown at pkg/backend/httpstate/client/client.go:1617

	}

	var resp apitype.StartUpdateResponse
	if err := pc.restCall(ctx, "POST", getUpdatePath(update), nil, req, &resp); err != nil {
		return 0, "", 0, err
	}

	return resp.Version, resp.Token, resp.JournalVersion, nil
}

// ListPolicyGroups lists all `PolicyGroups` the organization has in the Pulumi service.
func (pc *Client) ListPolicyGroups(ctx context.Context, orgName string, inContToken *string) (
	apitype.ListPolicyGroupsResponse, *string, error,
) {
	// NOTE: The ListPolicyGroups API on the Pulumi Service is not currently paginated.
	var resp apitype.ListPolicyGroupsResponse
	err := pc.restCall(ctx, "GET", listPolicyGroupsPath(orgName), nil, nil, &resp)
	if err != nil {
		return resp, nil, fmt.Errorf("List Policy Groups failed: %w", err)
	}
	return resp, nil, nil
}

// CreatePolicyGroup creates a new Policy Group in the given organization.
func (pc *Client) CreatePolicyGroup(
	ctx context.Context, orgName string, req apitype.CreatePolicyGroupRequest,
) error {
	if err := pc.restCall(ctx, "POST", listPolicyGroupsPath(orgName), nil, req, nil); err != nil {
		return fmt.Errorf("creating policy group: %w", err)
	}
	return nil
}

// GetPolicyGroup returns the details of a single Policy Group in the Pulumi
// service, including the list of Policy Packs applied to it and the stacks or
// cloud accounts that are members of the group.
func (pc *Client) GetPolicyGroup(

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Read the wrapped cause (%w) — check for 401/403/404 status and fix auth or org name accordingly
2. Run `pulumi whoami` to confirm your token is valid and has access to the organization
3. Verify the organization name exactly matches the Pulumi Service org
4. Retry after confirming network/proxy connectivity to api.pulumi.com

Example fix

null

if orgName == "" {
	return errors.New("organization name is required to list policy groups")
}
if os.Getenv("PULUMI_ACCESS_TOKEN") == "" {
	return errors.New("PULUMI_ACCESS_TOKEN not set")
}

func isAuthFailure(err error) bool {
	return strings.Contains(err.Error(), "401") || strings.Contains(err.Error(), "403")
}

groups, next, err := client.ListPolicyGroups(ctx, orgName)
if err != nil {
	var retriable = isNetworkError(err) // retry transient network failures
	if retriable { return listWithRetry(ctx, orgName, 3) }
	return fmt.Errorf("List Policy Groups failed: %w", err)
}

When it happens

Trigger: Calling Client.ListPolicyGroups when restCall fails: non-2xx response (401 bad token, 404 unknown orgName, 403 lacking org access) or an undecodable response body.

Common situations: Using `pulumi policy ls`/policy CLI workflows with a token lacking access to the organization; a typo'd org name; expired PULUMI_ACCESS_TOKEN; network/proxy issues.

Related errors

• creating policy group: %w
• getting policy group: %w
• updating policy group: %w
• creating agent Pulumi account: signup response did not inclu
• listing policy issues: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/0f5800a74c832802. Report an issue: GitHub.