API reference: Terraform

The deployable blueprint catalog: built-in registry blueprints + enabled platform-managed + your org's own custom blueprints (tier custom). Supports q= and provider= filters.

{ "blueprints": [ { "id": "aws/s3-bucket", "title": "S3 bucket", "provider": "AWS",
  "tfType": "aws_s3_bucket", "resourceType": "storage", "fields": [ { "key": "name", "type": "string" } ] } ] }

Create a Terraform workspace (folder) from a blueprint against a healthy cloud account — or a BLANK workspace with no blueprint. The criticality sets the approval policy: 'production' (default) requires a second approver; 'standard' lets the plan author self-approve. Optional varBindings bind variables to other workspaces' outputs; gitConnectionId picks which infra repo the workspace hydrates into; autoPipeline:false opts out of the auto-created infrastructure pipeline.

{ "blueprintId": "aws/s3-bucket", "cloudAccountId": 3,
  "name": "web-assets", "region": "us-east-1", "criticality": "standard" }

{ "workspace": { "id": 7, "provider": "AWS", "region": "us-east-1",
  "blueprintId": "aws/s3-bucket", "name": "web-assets", "status": "active",
  "criticality": "standard", "currentStateVersion": 0 } }

Compose the module from the blueprint(s)/members and the submitted variables, run the plan, evaluate policy (no-public-bucket / mandatory-tags / region-allowlist) and estimate the cost delta. Bound variables resolve server-side from the source workspace's applied outputs. The plan is saved on a run; new resources appear in Inventory as drafts (◌ planned). Async deployments return { state: "queued" }.

{ "runId": 12, "state": "planned", "diff": { "add": 1, "change": 0, "destroy": 0 },
  "policy": { "pass": true, "checks": [ … ] }, "costDelta": 8.5, "hash": "…" }

Approve a planned run. The policy must pass. On a 'production' workspace the approver must differ from the plan's author (separation of duties, 403 on self-approve); on a 'standard' workspace the plan author may approve their own run.

{ "runId": 12 }

{ "runId": 12, "state": "approving", "approverId": 5 }

Apply the SAVED, approved plan (integrity-hashed — never re-planned). By default the apply is recorded-only (modeled in inventory + state). It is REAL — OpenTofu runs against your live cloud with freshly-minted short-lived credentials — only when the platform runs CC_TF_RUNNER=real AND the target account has provisioning enabled; otherwise a real-runner apply is refused 409 { provisioningDisabled: true }. A failed apply marks the run failed with its logs, leaves state and inventory untouched, and keeps the workspace usable.

{ "runId": 12, "state": "succeeded", "created": 1, "stateVersion": 1, "outputs": { "bucket_name": "web-assets" } }

Assign / MOVE a synced resource INTO this workspace (folder). A workspace is a folder of resources; this reassigns membership and recompiles the target AND the resource's previous folder from all their members, returning both recompiled diffs + any address conflicts.

{ "nativeId": "i-0abc123def4567890" }

{ "nativeId": "i-0abc123def4567890", "previousWorkspaceId": null, "targetWorkspaceId": 7,
  "to": { "workspaceId": 7, "workspaceName": "web-tier", "memberCount": 1,
    "diff": { "add": 1, "change": 0, "destroy": 0 }, "conflicts": [], "committed": true,
    "stateVersion": 1, "repoWritten": true }, "from": null }

Edit a MANAGED member's settings (Edit-from-Inventory). The edits are validated against a per-type allowlist (e.g. compute instanceType, storage storageClass, network/subnet cidr, routetable routes, tags), staged on the resource, and the folder recompiles into a PLANNED run (diff ~1 to change + policy + Δ$/mo) that the normal approve/apply routes finish.

{ "edits": { "instanceType": "t3.large", "tags": { "env": "prod" } } }

Add another blueprint to this folder ({ blueprintId, vars }). One workspace can deploy MANY blueprints — the folder composes ALL its blueprint instances into one module, so the next plan shows the addition alongside what it already manages. GET lists the folder's blueprint instances.

{ "blueprintId": "aws/ec2-instance", "vars": { "name": "worker-1" } }

Remove a resource from this folder (unmanage it) and recompile the folder — the removed member shows as a delete in the diff. Native ids containing slashes (GCP/S3) can be passed via a ?nativeId= query, which wins over the path segment.

{ "nativeId": "i-0abc…", "previousWorkspaceId": 7, "targetWorkspaceId": null,
  "from": { "workspaceId": 7, "diff": { "add": 0, "change": 0, "destroy": 1 }, "memberCount": 0 }, "to": null }

Recompile the folder module from its member resources and return the diff + any conflicts, WITHOUT changing membership — the drift/recompile check. { commit: true } regenerates + commits (new state version + best-effort repo write) when there are no conflicts.

{ "commit": true }

{ "workspaceId": 7, "workspaceName": "web-tier", "memberCount": 2,
  "diff": { "add": 0, "change": 0, "destroy": 0 }, "conflicts": [], "committed": false, "stateVersion": 3 }

Import (adopt) any discovered resource into Terraform — including IAM (roles, policies, users, groups) and, via a generic fallback, any other service: generates real HCL + a Terraform import block (with the correct AWS import id per type — IAM roles/users/groups by name, a managed policy by ARN), records the adopt, marks the resource managed, and best-effort commits the HCL to your connected repo. See the Import existing resources guide.

{ "nativeId": "vpc-0aa1b2c3d4e5f0001" }

{ "managed": true, "nativeId": "vpc-0aa1b2c3d4e5f0001", "resourceType": "network",
  "tfType": "aws_vpc", "address": "aws_vpc.prod-use1", "mapped": true,
  "workspaceId": 7, "workspaceName": "imported-aws-us-east-1", "runId": 12,
  "stateVersion": 1, "repoPath": "terraform/imported/aws_vpc-prod-use1.tf",
  "repoWritten": true, "commitRef": "63c0111…" }