---
title: "POST /v1/origin/namespaces/{namespaceSlug}/apps"
method: POST
path: "/v1/origin/namespaces/{namespaceSlug}/apps"
tags: ["OriginService"]
---

# POST /v1/origin/namespaces/{namespaceSlug}/apps

`POST /v1/origin/namespaces/{namespaceSlug}/apps`

## Request

- Base URL: `https://api.cursor.com`
- URL: `https://api.cursor.com/v1/origin/namespaces/{namespaceSlug}/apps`
- Auth: HTTP bearer

Creates an app owned by a namespace.

 Apps are created private. `public_key` must be a PEM SPKI Ed25519 public
 key; the caller generates the key pair locally and retains the private
 key, and only the public key is stored, for app JWT verification.
 Invalid webhook URLs, event types, redirect URIs, or scopes are rejected
 as invalid arguments.

## Path parameters

- `namespaceSlug` string, required

## Request body

- object
  - `displayName` string, required: Human-facing app name. Must not be empty.
  - `publicKey` string, required: PEM SPKI Ed25519 public key for the app's signing key pair. The caller generates the key pair locally and retains the private key; only the public key is stored, for app JWT verification.
  - `webhookUrl` string: Outbound webhook delivery URL: an absolute https URL. Empty means the app receives no webhook deliveries.
  - `events` string[]: Outbound webhook event subscriptions (for example `pull_request.created` or `repository.pushed`). Unknown event types are rejected. Empty subscribes to no events: the app then receives only the `installation.*` events, which are always delivered and cannot be listed here. An event the app does not subscribe to produces no delivery.
  - `description` string: Short app description.
  - `websiteUrl` string: Publisher website: an absolute https URL.
  - `installationRedirectUris` string[]: OAuth install callback allowlist: redirect URIs an app-initiated install may return to (absolute https URI, no fragment), matched exactly at authorize time.
  - `defaultScopes` string[]: Default scopes offered when the app is installed, as catalog scope strings (for example `repository:contents:read`). Installs still accept scopes explicitly.

## Response `200`

OK

- App: An Origin app.
  - `id` string: Globally unique app identifier.
  - `displayName` string
  - `webhookUrl` string
  - `events` string[]: Outbound webhook event subscriptions. The `installation.*` events are always delivered and never appear here.
  - `createdAt` string, date-time
  - `updatedAt` string, date-time
  - `installationRedirectUris` string[]: OAuth install callback allowlist: redirect URIs an app-initiated install may return to, matched exactly at authorize time.
  - `namespaceSlug` string: Slug of the namespace that owns (publishes) the app.
  - `description` string: Publisher-provided app description. Empty when unset.
  - `websiteUrl` string: Publisher website. Empty when unset.
  - `defaultScopes` string[]: Default scopes offered when the app is installed, as catalog scope strings.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: The addressed resource, or its repository, does not exist or is not visible to the caller. Not-found and no-access are deliberately indistinguishable; a 404 never confirms that the resource does not exist.
- `429`: Too Many Requests
- `default`: Default error response

---

[API](https://skmtc.dev/cursor/apis/cursor-origin-api.md) - [All operations](https://skmtc.dev/cursor/apis/cursor-origin-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cursor/apis/cursor-origin-api/revisions/cbc1547d6ef7?raw)