---
title: "Create App"
method: POST
path: "/apps"
tags: ["Apps"]
---

# Create App

`POST /apps`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/apps`
- Auth: HTTP bearer

PREVIEW. This endpoint is deployed but gated: it returns 404 unless the hosted app platform is enabled for your organization. It is published here so the contract describes the whole surface, not so it can be called today.

Create an app. It starts in `draft` and serves no traffic until published.

The slug is unique within your organization, not globally — two builders may
both ship a `crm`. A collision returns 409 naming `slug`.

## Headers

- `Authorization` string, nullable
- `X-Org-Id` string, nullable

## Request body

- CreateAppRequest: Mirrors `CreateAppInput`.
  - `name` string, required
  - `slug` string, required: Stable identifier, unique within your organization. Lowercased on write, so `CRM` and `crm` are the same app.
  - `registered_origins` string[]: https-only origins a browser app token may be presented from. An http origin is rejected — a bearer token sent over http is a token disclosed to the network.

## Response `201`

Successful Response

- ApiResponseAppResponse
  - `data` AppResponse, required: One builder-owned app. Mirrors `AppDto`.
    - `app_id` string, required
    - `builder_org_id` string, required
    - `slug` string, required
    - `name` string, required
    - `status` string, required: Lifecycle state: `draft`, `published`, `suspended` or `archived`. `active` is accepted on write as a legacy spelling of `published`.
    - `registered_origins` string[]: https-only origins a browser app token may be presented from.
    - `default_hostname` string, nullable
    - `source_repo_url` string, nullable: Where this app's code lives. Null until bound.
    - `source_provider` string, nullable
    - `source_default_branch` string, nullable
    - `source_credential_ref` string, nullable: A POINTER to the credential (a secret-manager path), never the credential itself.
    - `created_at` string, date-time, nullable
    - `archived_at` string, date-time, nullable
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/2e7cfa0ca921?raw)