---
title: "Set App Source"
method: PUT
path: "/apps/{app_id}/source"
tags: ["Apps"]
---

# Set App Source

`PUT /apps/{app_id}/source`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/apps/{app_id}/source`
- Auth: HTTP bearer

Bind this app to the repository a build should fetch (J1).

Idempotent, and a REPLACE rather than a merge: every field is written, so
rebinding from one provider to another cannot leave the previous provider's
credential pointer behind. A build fetching a new repo with a stale
credential is the failure this shape exists to prevent.

There is no GET here on purpose. Source is 1:1 with the app and comes back on
`GET /apps/{app_id}` through `AppResponse`, so a separate read would be a
second thing to keep in step for no new information.

`credential_ref` is a POINTER to a secret, never a secret. The DTO says so and
the column comment says so, because a token written here would also live in
every backup of the control plane and in this route's own response.

## Path parameters

- `app_id` string, required

## Headers

- `Authorization` string, nullable
- `X-Org-Id` string, nullable

## Request body

- AppSourceRequest: Bind an app to the repository a build should fetch (J1). PROVIDER IS VALIDATED HERE, NOT BY A CHECK CONSTRAINT. `ensure_public_tables` emits `ADD COLUMN IF NOT EXISTS`, which cannot add a CHECK to an already created table, and editing the constraint tuple alone is a silent no-op. So the vocabulary lives in `SOURCE_PROVIDERS` and this DTO is what enforces it, the same way `repos_router` already validates its provider. `credential_ref` is a POINTER, and the description says so on the wire. A builder who pastes a token here has put it in the control-plane row, in every backup of it, and in the response body of `GET /apps/{app_id}`. There is no way to un-send that, so the field is named and documented to make the mistake hard rather than merely regrettable.
  - `repo_url` string, required: Clone URL.
  - `provider` string, required: One of: github, gitlab, bitbucket.
  - `default_branch` string, nullable: Defaults to the repository's own default when omitted.
  - `credential_ref` string, nullable: Secret-manager PATH for the fetch credential. Never the credential itself.

## Response `200`

Successful Response

- ApiResponseAppResponse
  - `data` AppResponse, required: One builder-owned app. Mirrors `AppDto`.
    - `app_id` string, required
    - `builder_org_id` string, required
    - `slug` string, required
    - `name` string, required
    - `status` string, required: Lifecycle state: `draft`, `published`, `suspended` or `archived`. `active` is accepted on write as a legacy spelling of `published`.
    - `registered_origins` string[]: https-only origins a browser app token may be presented from.
    - `default_hostname` string, nullable
    - `source_repo_url` string, nullable: Where this app's code lives. Null until bound.
    - `source_provider` string, nullable
    - `source_default_branch` string, nullable
    - `source_credential_ref` string, nullable: A POINTER to the credential (a secret-manager path), never the credential itself.
    - `created_at` string, date-time, nullable
    - `archived_at` string, date-time, nullable
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)