---
title: "Create App Deployment"
method: POST
path: "/apps/{app_id}/deployments"
tags: ["App Deployments"]
---

# Create App Deployment

`POST /apps/{app_id}/deployments`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/apps/{app_id}/deployments`
- Auth: HTTP bearer

Queue a deployment from a pinned source ref.

Returns `queued`. Nothing builds yet -- the provisioner (M6-8) is what moves
it to `building`. Recording the intent before any infrastructure exists is
deliberate: it makes the control plane the source of truth for what SHOULD be
running, which is what a reconciler needs to exist against.

## Path parameters

- `app_id` string, required

## Headers

- `Authorization` string, nullable
- `X-Org-Id` string, nullable

## Request body

- CreateDeploymentRequest: Start a deployment from a pinned source ref. ``source_ref`` is a COMMIT-ish, not a branch name. A branch moves, so a deployment recorded against one cannot answer "what is running right now" a week later -- which is the question a rollback has to answer.
  - `source_ref` string, required: Immutable source reference (commit SHA). Branches move; deployments must not.
  - `schema_version_id` string, nullable: Schema version this build expects. Pinned so a rollback restores the matching schema, not merely the matching image.

## Response `201`

Successful Response

- ApiResponseDeploymentResponse
  - `data` DeploymentResponse, required
    - `deployment_id` string, required
    - `app_id` string, required
    - `status` string, required
    - `source_ref` string, nullable
    - `image_digest` string, nullable
    - `schema_version_id` string, nullable
    - `last_error_sanitized` string, nullable: Sanitized at the write. Build logs carry secrets and other tenants' ids.
    - `created_at` string, date-time, nullable
    - `deployed_at` string, date-time, nullable
    - `build_started_at` string, date-time, nullable: When the build started. `null` means it was not measured.
    - `build_finished_at` string, date-time, nullable: When the build ended, at `promoting` or at `failed`. Not at `deployed`: that is reached after traffic is taken, so measuring to it would count promotion and rollout as build time.
    - `build_seconds` number, nullable: Measured build duration. `null` means NOT MEASURED, never zero: a build whose transitions were not reported has no duration, and a metering pipeline reading 0 would bill nothing and look correct.
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)