Pulumi organization webhooks, services, templates, stack restore and transfer support, and registry/package usage surfaces. This leaf carries 29 of 548 runtime-admissible, nondeprecated operations generated from Pulumi's byte- and hash-locked official 3.0.3 document (16a5dbf2f2e6…). The managed-service origin is fixed at https://api.pulumi.com; the selected encrypted connection supplies the complete documented Authorization token value, while static requests use the required application/vnd.pulumi+8 media version except where the operation explicitly selects YAML, text, Markdown, JSON, or tar. All documented request bodies are required bounded verbatim payloads because the current generator omits requestBody.required everywhere. JSON responses preserve unsafe integers; tar bytes enter the warehouse only as file_ref. Proven token/page loops paginate automatically and ambiguous loops stay explicit single-response operations. Reads are uncached and not approval-gated, every mutation requires approval, and failures receive no hidden retry. No infrastructure, environment, stack, agent, or account record is misrepresented as a user-work Source.