pulumi/pulumi · error

unable to lookup default org: %w

Error message

unable to lookup default org: %w

What it means

newStack wraps an error from b.defaultOrg.Result(ctx) — the backend's cached lookup of the user's default organization — when constructing a cloudStack representation from an apitype.Stack. Without the default org the stack object cannot be fully initialized, so GetStack/CreateStack fail. The wrapped cause is typically an API/HTTP error from the service.

Source

Thrown at pkg/backend/httpstate/stack.go:132

	snapshot atomic.Pointer[*deploy.Snapshot]
	// snapshotStackOutputs contains the stack outputs of the latest deployment snapshot, allocated on first use.
	// It's valid for the outputs property map itself to be nil.
	snapshotStackOutputs atomic.Pointer[property.Map]
	// b is a pointer to the backend that this stack belongs to.
	b *cloudBackend
	// tags contains metadata tags describing additional, extensible properties about this stack.
	tags map[apitype.StackTagName]string
	// escConfigEnv caches if we expect this stack to have its config stored in an ESC environment.
	escConfigEnv *string
}

func newStack(ctx context.Context, apistack apitype.Stack, b *cloudBackend) (Stack, error) {
	stackName, err := tokens.ParseStackName(apistack.StackName.String())
	contract.AssertNoErrorf(err, "unexpected invalid stack name: %v", apistack.StackName)

	defaultOrg, err := b.defaultOrg.Result(ctx)
	if err != nil {
		return &cloudStack{}, fmt.Errorf("unable to lookup default org: %w", err)
	}

	var escConfigEnv *string
	if apistack.Config != nil {
		escConfigEnv = &apistack.Config.Environment
	}

	// Now assemble all the pieces into a stack structure.
	return &cloudStack{
		ref: cloudBackendReference{
			owner:      apistack.OrgName,
			project:    tokens.Name(apistack.ProjectName),
			defaultOrg: defaultOrg,
			name:       stackName,
			b:          b,
		},
		orgName:          apistack.OrgName,
		currentOperation: apistack.CurrentOperation,

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Re-authenticate with `pulumi login` (or refresh PULUMI_ACCESS_TOKEN) to fix token problems.
2. Check connectivity to the Pulumi API endpoint (app.pulumi.com or self-hosted URL) — curl the /api endpoints to verify.
3. Verify the account has at least one organization or set an explicit default org in the Pulumi Cloud console.
4. Retry on transient failures; if using a self-hosted backend, verify the service version supports the default-org endpoint.

Example fix

// before
export PULUMI_ACCESS_TOKEN=pul- stale-token

// after
pulumi logout && pulumi login   # obtain a fresh token

// preflight: verify the token can resolve the user's orgs
resp, err := http.Get(cloudURL + "/api/user")
if err != nil || resp.StatusCode != 200 {
    return fmt.Errorf("pulumi token/org lookup unhealthy (status %d); re-run `pulumi login`", status(resp))
}

stk, err := newStack(ctx, apistack, b)
if err != nil && strings.Contains(err.Error(), "unable to lookup default org") {
    // transient API/auth issue — back off and retry once
    time.Sleep(2 * time.Second)
    stk, err = newStack(ctx, apistack, b)
}
if err != nil {
    return fmt.Errorf("stack lookup failed: %w", err)
}

When it happens

Trigger: Calling GetStack or CreateStack against the Pulumi Cloud backend when the default-org API request fails: invalid or expired API token, network error, or a backend that cannot resolve the caller's default organization.

Common situations: Expired or revoked PULUMI_ACCESS_TOKEN; a token for an SSO/identity whose default org can't be determined; the account belonging to no organization; transient 5xx or connectivity failures; behind a corporate proxy blocking the API.

Related errors

• failed to get stack tags for %s: %w
• cannot set config for a stack with cloud config
• cloud stacks must have exactly 1 import
• converting engine event: %w
• listing organization roles: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/53d72a8e2897c440. Report an issue: GitHub.