---
title: "Save a blueprint"
method: POST
path: "/v1/blueprints"
tags: ["Blueprints"]
---

# Save a blueprint

`POST /v1/blueprints`

## Request

- Base URL: `https://api.banksync.io`
- URL: `https://api.banksync.io/v1/blueprints`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Save a portable template to the workspace library without publishing it — typically what `POST /blueprints/export` answered. It must parse (`INVALID_BLUEPRINT`) and carry no workspace ids (`PORTABILITY_VIOLATION`). A workspace keeps up to 200 (`QUOTA_EXCEEDED`).

## Headers

- `Idempotency-Key` string: Makes a retry safe: the same key with the same request replays the first answer for 24 hours instead of running twice, and the same key with a different request is a 409 `IDEMPOTENCY_KEY_REUSED`. Refusals a retry can outlive — 408, 409, 423, 425, 429 and every 5xx — are never replayed, so retrying with the same key after the cause clears runs the request.

## Request body

- object
  - `blueprint` object, required: A portable blueprint (`contract: "flagbase.blueprint/1"`, `title`, `resources`, `inputs`), as `POST /blueprints/export` or `GET /blueprints/{blueprintId}` answers it. It must carry no workspace ids.
  - `visibility` 'private' | 'workspace': Who sees it: `private` (only its owner, a signed-in member) or `workspace` (every member). Only the owner changes it.

## Response `201`

The saved blueprint

- object
  - `success` true, required
  - `data` object, required
    - `blueprint` object, required
      - `id` string, required: Saved blueprint id — the `blueprintId` other operations take
      - `key` string, required
      - `title` string, required
      - `description` string, nullable, required
      - `contract` string, required
      - `digest` string, required
      - `version` integer, required
      - `resourceCount` integer, required
      - `kinds` string[], required
      - `forkedFromReleaseId` string, nullable, required
      - `visibility` 'private' | 'workspace', required: `private`: only its owner sees it; `workspace`: every member does
      - `createdAt` string, nullable, required
      - `updatedAt` string, nullable, required
      - `deletedAt` string, nullable, required
      - `blueprint` object, required

## Other responses

- `400`: Invalid input — `code` names it: `VALIDATION_FAILED`, `INVALID`, `INVALID_BLUEPRINT` (not a blueprint this workspace can read), `PORTABILITY_VIOLATION` (it still carries workspace ids), `UNSAFE_BLUEPRINT`, `INVALID_BINDINGS` (an input is missing or does not fit), `RESTORE_WINDOW_PASSED`; `details[]` names each field
- `401`: Unauthorized
- `403`: Forbidden — a missing `marketplace:read` / `marketplace:write` scope, a role below editor for a change, an installed app outside the public marketplace, an unverified listing already installed in ten workspaces (`INSTALL_CAP_REACHED`), or a template that needs more tables, feeds or enrichments than the workspace plan has left (`PLAN_LIMIT_REACHED`)
- `404`: Not found — something this workspace may not see answers exactly as something that does not exist; or the marketplace is not enabled for this workspace
- `409`: Conflict — it changed since you read it (`STALE`), it is busy or in the wrong state (`INVALID_STATE`), the listing cannot be installed (`NOT_INSTALLABLE`), a key is taken (`KEY_TAKEN`), or an existing container does not fit (`ADOPTION_CONFLICT`)
- `429`: Too many — the key’s rate limit, or a marketplace quota (`QUOTA_EXCEEDED`: 200 saved templates per workspace, 50 installs per hour). `Retry-After` says when to come back.
- `503`: The marketplace is temporarily unavailable; retry shortly

---

[API](https://skmtc.dev/banksync/apis/banksync-api.md) · [All operations](https://skmtc.dev/banksync/apis/banksync-api/llms.txt) · [OpenAPI document](https://skmtc.dev/banksync/apis/banksync-api/revisions/94465f5ee922?raw)