---
title: "Save code that runs on every event"
method: PUT
path: "/api/v1/apps/{slug}/code"
---

# Save code that runs on every event

`PUT /api/v1/apps/{slug}/code`

## Request

- Base URL: `https://anyhook.net`
- URL: `https://anyhook.net/api/v1/apps/{slug}/code`
- Auth: HTTP bearer

Save an ES module that runs in a sandboxed Node.js on every event this app receives, with AnyHook's retries and replay around it. `export default async function (event, { env, store }) {}`, where event is `{ method, headers, body, raw_body, delivery_id, attempt }` (method is always POST; the query string, path and caller IP are not kept; attempt is 0 on a test run), or a Pipedream Node.js code step (`defineComponent({ run({ steps, $ }) {} })`) with the changes listed at https://anyhook.net/migrate/pipedream. npm packages it imports are installed when it is saved (pin a version as `pkg@1.2.3`); a save that installs new packages can take a few minutes, and a failed install changes nothing (400 with npm's output). Throwing fails the delivery, which is retried on the plan's attempts. Pro and Scale; runs are capped per month with no overage, and retries, test runs, replays and schedule firings each count.

## Path parameters

- `slug` string, required

## Request body

- object
  - `code` string, required: The handler's source, at most 64,000 bytes as UTF-8.
  - `secrets` object: Environment variables for the code (env.NAME, or process.env.NAME in a Pipedream step). Merged into the saved ones; null removes a name. Names are letters, digits and underscores, not starting with a digit; PATH, HOME, NODE_OPTIONS, NODE_PATH, PWD and names starting with ANYHOOK_ belong to the runtime. A save past the limit on the number of secrets or on a value's length answers 400 naming the limit.
  - `schedule` string, nullable: Also run on a cron schedule: five fields, UTC unless prefixed CRON_TZ=Area/City. Each firing posts an anyhook.schedule event to the app's own URL, so it counts as a run and as an event, and it fires only while the code is on. null removes it; omit to keep it. The app's source must be generic or auto, with no signing secret; otherwise 400.
  - `enabled` boolean: Whether events run the code. false saves it switched off (it runs only through POST .../code/test). Omitted: a first save goes live, later saves keep the current state; the dashboard saves new code switched off. While another destination still handles the same events, as in a migration, save with false and turn it on after removing that destination. A switch takes up to a minute to reach every edge location.

## Response `200`

Saved

- object
  - `app` string
  - `plan_allows` boolean: False on Free: code handlers are on Pro and Scale.
  - `code` string, nullable: The handler's source; null when the app has none.
  - `secret_names` string[]: Names only; values never leave the server.
  - `packages` object: npm packages the code imports, name → version ("latest" unless pinned), installed when it was saved.
  - `schedule` string, nullable: The cron it also runs on, if any.
  - `receiving` boolean: Whether the app's events reach the code (its run destination is present and enabled).
  - `destination` 'on' | 'off': on: the app's run destination is there and events run the code. off: it is not, and the code runs only through POST .../code/test.
  - `disabled` boolean
  - `runs_this_month` integer
  - `runs_per_month` integer, nullable: The plan's monthly run cap; null = unlimited.

## Other responses

- `400`: Invalid code, secrets or schedule, or npm could not install the packages (npm's output included)
- `403`: Plan without code handlers, read-only key, or no room for another destination
- `503`: Installing packages failed on AnyHook's side; nothing was saved. Try again.

## Changes

- **2026-10-19** `ddf038fb32fc`: 1 info
  - added the non-success response with the status `503`

[Operation history](https://skmtc.dev/anyhook/apis/anyhook-api/changes/api/v1/apps/:slug/code/put.md)

---

[API](https://skmtc.dev/anyhook/apis/anyhook-api.md) · [All operations](https://skmtc.dev/anyhook/apis/anyhook-api/llms.txt) · [OpenAPI document](https://skmtc.dev/anyhook/apis/anyhook-api/revisions/ddf038fb32fc?raw)