Spacelift

Spacelift is an infrastructure orchestration platform that sits on top of existing IaC tools (Terraform, OpenTofu, Pulumi, Ansible) to add GitOps workflows, policy enforcement, drift detection, and access controls. For teams already using Terraform or Pulumi, Spacelift provides the orchestration layer that makes those tools enterprise-ready — with audit trails, approval workflows, and policy gates that raw IaC tools lack. Agents can interact with Spacelift's API to trigger runs, query drift detection results, and monitor stack health across the managed infrastructure portfolio.

Authentication uses API tokens for the GraphQL API. Spacelift's access control model is stack-level — API tokens can be scoped to specific stacks, enabling least-privilege agent access for agents responsible for specific infrastructure domains. Teams should use stack-scoped tokens for agent automation rather than broad organization tokens where possible.

Documentation covers the GraphQL API and key concepts thoroughly. The policy language (Rego/OPA-based) documentation is important for teams using Spacelift's policy enforcement capabilities. Teams integrating Spacelift for agent-driven infrastructure change management will find the documentation covers the orchestration concepts and API surface with good depth.

The GraphQL API covers stacks, runs, contexts (shared variable sets), policies, and drift detection. Agents can trigger stack runs programmatically (responding to upstream events), query current stack state and outputs, and retrieve drift detection results for infrastructure compliance monitoring. The policy API enables agents to check whether proposed infrastructure changes would pass configured policies before triggering actual runs.

Reliability is vendor-managed for Spacelift Cloud. The orchestration layer adds reliability features to underlying IaC tools — retry logic, run queuing, and state locking prevent the concurrency issues that raw Terraform remote state backends can encounter with parallel automation. Drift detection runs on configurable schedules and surfaces infrastructure state changes that occurred outside of IaC workflows.