CUcursor
OriginService

POST /v1/origin/namespaces/{namespaceSlug}/apps

Creates an app owned by a namespace.

Apps are created private. public_key must be a PEM SPKI Ed25519 public key; the caller generates the key pair locally and retains the private key, and only the public key is stored, for app JWT verification. Invalid webhook URLs, event types, redirect URIs, or scopes are rejected as invalid arguments.

Request

  • Base URL
    https://api.cursor.com
  • Auth
    HTTP bearer

Path parameters

namespaceSlugstring required

Slug of the namespace that will own the app.

Request body

displayNamestring required

Human-facing app name. Must not be empty.

publicKeystring required

PEM SPKI Ed25519 public key for the app's signing key pair. The caller generates the key pair locally and retains the private key; only the public key is stored, for app JWT verification.

webhookUrlstring

Outbound webhook delivery URL: an absolute https URL. Empty means the app receives no webhook deliveries.

eventsstring[]

Outbound webhook event subscriptions (for example pull_request.created or repository.pushed). Unknown event types are rejected. Empty subscribes to no events: the app then receives only the installation.* events, which are always delivered and cannot be listed here. An event the app does not subscribe to produces no delivery.

descriptionstring

Short app description.

websiteUrlstring

Publisher website: an absolute https URL.

installationRedirectUrisstring[]

OAuth install callback allowlist: redirect URIs an app-initiated install may return to (absolute https URI, no fragment), matched exactly at authorize time.

defaultScopesstring[]

Default scopes offered when the app is installed, as catalog scope strings (for example repository:contents:read). Installs still accept scopes explicitly.

Response

OK

idstring

Globally unique app identifier.

displayNamestring
webhookUrlstring
eventsstring[]

Outbound webhook event subscriptions. The installation.* events are always delivered and never appear here.

createdAtstring date-time
updatedAtstring date-time
installationRedirectUrisstring[]

OAuth install callback allowlist: redirect URIs an app-initiated install may return to, matched exactly at authorize time.

namespaceSlugstring

Slug of the namespace that owns (publishes) the app.

descriptionstring

Publisher-provided app description. Empty when unset.

websiteUrlstring

Publisher website. Empty when unset.

defaultScopesstring[]

Default scopes offered when the app is installed, as catalog scope strings.

Changes

No recorded changes to this operation across all 1 revision of this API.