---
title: "Apply App Manifest"
method: POST
path: "/apps/{app_id}/manifest"
tags: ["Apps"]
---

# Apply App Manifest

`POST /apps/{app_id}/manifest`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/apps/{app_id}/manifest`
- Auth: HTTP bearer

Apply a `graph8.app.yaml` to this app.

Publishes the `objects:` block as a schema version through the same path
`POST /{app_id}/schema-versions` uses, including the digest idempotency and
the failure-isolated tenant fan-out, and stores `frontend:` / `backend:` as
the build config a later deploy reads.

Refuses when the manifest's `app.slug` names a DIFFERENT app than the one in
the path. Both halves of that mismatch are plausible mistakes -- a copied
file, a wrong id in a script -- and either one silently applied would
publish one app's schema into another app's tenants.

A manifest with no `objects:` publishes nothing. That is not an oversight:
an empty schema would archive every object the app has ever declared across
every consented tenant, so `schema_publish` refuses it, and a build-config
only manifest is a legitimate thing to apply.

## Path parameters

- `app_id` string, required

## Headers

- `Authorization` string, nullable
- `X-Org-Id` string, nullable

## Request body

- ManifestRequest: A `graph8.app.yaml` document, verbatim.
  - `manifest` string, required: The full graph8.app.yaml document as text. Sent verbatim, including newlines. Rejected above 256 KiB by the parser.

## Response `200`

Successful Response

- ApiResponseApplyManifestResponse
  - `data` ApplyManifestResponse, required: What an apply actually did, part by part. Each field answers "did this half happen", because a manifest declaring only `objects:` and one declaring only `backend:` are both legal and do different amounts of work. A caller should never have to infer that from a 200.
    - `app_id` string, required
    - `summary` ManifestSummary, required: What a valid manifest declares. The echo of a successful parse. Deliberately a summary and not the parsed document: a builder who wants the document already has it, and echoing it back would make this response the second place the shape is defined.
      - `version` integer, required
      - `app_slug` string, nullable
      - `app_name` string, nullable
      - `object_slugs` string[]
      - `attribute_count` integer
      - `has_frontend` boolean
      - `has_backend` boolean
    - `schema_version` SchemaVersionResponse: One published (or draft) object-schema version.
      - `schema_version_id` string, required
      - `app_id` string, required
      - `version` integer, required: Human-facing ordinal. Nothing keys on it; the digest is the identity.
      - `digest` string, required: SHA-256 of the canonical schema. Re-publishing the same schema resolves here.
      - `status` string, required
      - `manifest` object: The stored canonical schema. Self-describing, so the version needs no other source.
      - `created_at` string, date-time, nullable
      - `published_at` string, date-time, nullable
      - `deprecated_at` string, date-time, nullable
    - `schema_created` boolean: False when an identical schema was already published. The version named above exists either way; this is what says nothing changed.
    - `materialization` MaterializationSummary: How the fan-out went, as counts. Never tenant ids -- see module docstring.
      - `total` integer
      - `ready` integer
      - `failed` integer
      - `skipped` integer: Tenants already materialized on this exact digest.
    - `deploy_config_stored` boolean
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)