`POST /apps` — provision a fresh app and issue its first key in a single round trip.

POST/apps

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

POST /apps body.

description?|

Optional free-form description. Visible only in the admin UI; not displayed in audit logs.

name*string

Human-friendly label. Required, max 80 chars. Surfaces in the admin UI and every audit line touching the app.

published?|

ADR-0050 §6 catalog flag. Defaults to false. Inert — nothing reads it for any decision today.

required_permissions?array<string>|

The resource:action manifest this app declares it needs (ADR-0050 §1). Absent and [] are both legal and both mean "declares nothing"; declaring confers nothing — the bound is the installer's authority at install time. Validated on write: every token must parse and must not name an owner-only lever.

role?null|

team_ids?array<string>|

Initial team memberships. Each must be an existing team in the org; the handler doesn't validate that here, but follow-ons will land team-existence checks once the team-leaf exposes a lookup helper.

Response Body

`application/json`

curl -X POST "https://example.com/apps" \  -H "Content-Type: application/json" \  -d '{    "name": "string"  }'

{  "created_at": "string",  "description": "string",  "email": "string",  "id": "string",  "name": "string",  "owner_user_id": "string",  "published": true,  "required_permissions": [    "string"  ],  "role": "owner",  "team_ids": [    "string"  ]}

`POST /apps` — provision a fresh app and issue its first key in a single round trip.

Request Body

Response Body

201application/json

400

403

`application/json`