---
title: "Register an app"
method: POST
path: "/api/orgs/{slug}/apps"
tags: ["Apps"]
---

# Register an app

`POST /api/orgs/{slug}/apps`

## Request

- Base URL: `https://git.cafe`
- URL: `https://git.cafe/api/orgs/{slug}/apps`
- Auth: one of:
  - API key in cookie `gc-session`
  - HTTP bearer
  - HTTP basic
  - HTTP token

Registers an app owned by this organization and seals its first manifest revision. An app with webhooks gets its signing secret in this response only. Requires authenticated authority and enforces current resource policy.

## Path parameters

- `slug` string, required

## Request body

- object
  - `slug` string, required
  - `manifest` object, required
    - `schema_version` 1, required
    - `name` string, required
    - `summary` string, required
    - `listing` object
      - `category` 'coding-agents' | 'code-review' | 'ci-deploy' | 'security-quality' | 'workflow-automation', required
      - `description` string, required
    - `links` object, required
      - `homepage` string, uri, required
      - `support` string, uri, required
      - `privacy` string, uri, required
    - `capabilities` object, required
      - `bot` object, required
        - `display_name` string, required
        - `assignable` boolean
        - `mentionable` boolean
      - `setup_url` string, uri
      - `webhooks` object
        - `url` string, uri, required
        - `events` string[], required
      - `oauth` object
        - `redirect_uris` string[], required
    - `permissions` object, required
      - `autonomous` object, required
        - `scopes` object[], required
          - `kind` 'repo' | 'branch' | 'pr' | 'issue' | 'comment' | 'org' | 'team', required
          - `family` string, required
          - `level` 'read' | 'write' | 'admin', required
      - `user` object
        - `scopes` object[], required
          - `kind` 'repo' | 'branch' | 'pr' | 'issue' | 'comment' | 'org' | 'team', required
          - `family` string, required
          - `level` 'read' | 'write' | 'admin', required
        - `audiences` string[], required

## Response `201`

Response for status 201

- object
  - `id` string, required
  - `slug` string, required
  - `owner` string, required
  - `iconUrl` string, nullable, required
  - `status` 'draft' | 'active' | 'suspended' | 'retired', required
  - `suspended` boolean, required
  - `firstParty` boolean, required
  - `revision` integer, required
  - `manifestHash` string, required
  - `manifest` object, required
    - `schema_version` 1, required
    - `name` string, required
    - `summary` string, required
    - `listing` object
      - `category` 'coding-agents' | 'code-review' | 'ci-deploy' | 'security-quality' | 'workflow-automation', required
      - `description` string, required
    - `links` object, required
      - `homepage` string, uri, required
      - `support` string, uri, required
      - `privacy` string, uri, required
    - `capabilities` object, required
      - `bot` object, required
        - `display_name` string, required
        - `assignable` boolean
        - `mentionable` boolean
      - `setup_url` string, uri
      - `webhooks` object
        - `url` string, uri, required
        - `events` string[], required
      - `oauth` object
        - `redirect_uris` string[], required
    - `permissions` object, required
      - `autonomous` object, required
        - `scopes` object[], required
          - `kind` 'repo' | 'branch' | 'pr' | 'issue' | 'comment' | 'org' | 'team', required
          - `family` string, required
          - `level` 'read' | 'write' | 'admin', required
      - `user` object
        - `scopes` object[], required
          - `kind` 'repo' | 'branch' | 'pr' | 'issue' | 'comment' | 'org' | 'team', required
          - `family` string, required
          - `level` 'read' | 'write' | 'admin', required
        - `audiences` string[], required
  - `webhookSecret` object
    - `secret` string, required
    - `keyVersion` integer, required

## Other responses

- `400`: The request is invalid.
- `401`: Authentication is required, or the supplied credential is invalid.
- `403`: The credential does not permit this operation. A `code`, when present, names the refusal.
- `404`: The resource does not exist or is not visible to the caller.
- `409`: The request conflicts with the current state. A `code`, when present, names the refusal; `retryable` says whether the same request can succeed later, and `operationId` names the operation in the way.
- `429`: A rate limit is exhausted. Wait Retry-After seconds; the value is a hint, so back off on a repeat 429.
- `503`: A required service is temporarily unavailable; retry later.

---

[API](https://skmtc.dev/gitcafe/apis/git-cafe-api.md) - [All operations](https://skmtc.dev/gitcafe/apis/git-cafe-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gitcafe/apis/git-cafe-api/revisions/9fa233d2986d?raw)