Create a new QA project, optionally starting automated exploration

Project name

URL of the application to test

URL to receive bug report notifications. Payload: { body, referrer, callback_url, bug_id, title, severity, description, reproduction_steps, expected_behavior, actual_behavior, replay_recording_id, analysis, polish_category }

An unused email returned by POST /api/v1/project-emails for this account. Assigned before QA starts and used for the project inbox and default login identity. Explicit login credentials retain precedence. Omit to use the automatically derived inbox. Invalid, foreign, or already assigned emails return 400.

URL to receive a notification when QA on this project finishes and has nothing left to do (no queued/running tasks or in-progress test runs, explorations, polish passes, or guidance updates). Fires once per idle transition. Payload: { event: "qa.finished", referrer, project_id, project_name, project_url, bug_count, open_bug_count, resolved_bug_count, finished_at }

Endpoint for creating Replay recordings of backend requests. Agents POST { requestId } to trigger, GET ?requestId=<id> to poll.

Endpoint for fetching backend/database logs. Agents GET ?start=<ISO>&end=<ISO> to retrieve logs.

Markdown document describing expected app features. When provided, it is given to the app exploration as additional context for planning test journeys (the exploration still browses and records the app).

Set false to create an active project without the initial exploration or smoke-test journey/runs. Session ingestion, reviews, reports, and session-driven reproductions remain enabled. Start base-site QA later with POST /api/v1/projects/{project_id}/explorations. This is a creation-time option, not a project pause or a restriction on explicitly requested work.

Instructions for the initial AI exploration

Replay recording UUID to analyze for bugs. When provided, the project analyzes this single recording instead of exploring the target URL. target_url is not required when recording_id is set.

Set to true when target_url is only reachable from your own machine (e.g. http://localhost:3000) and not from the public internet. The project starts gated — it will not run tests until you connect a reverse-proxy tunnel. After creating the project, run replayqa proxy --project <project_id> on a machine that can reach target_url. The old setup instructions remain available from GET /api/v1/projects/{project_id}/reverse-proxy as instructions.

Wall-clock limit in minutes for each new test run, including queueing, retries and recording analysis. Omit or send null for no limit. Each run snapshots its deadline when created; changing this setting affects future runs only. When a deadline expires, the project is paused, all remaining project work is cancelled and eligible unfinished work is refunded. Finished results are preserved. Running containers are stopped by the next deadline sweep (every minute in production; previews use the five-minute reap sweep).

Credit budget cap for this project — the maximum number of credits QA may spend on it. QA pauses once this cap is reached (raise it later to resume). Rough guide: ~10 = smoke test, 20–50 = thorough, 50+ = broad coverage. Off by default: omit it to leave the project with no per-project cap (QA is bounded only by your account balance).

Waive the security pass's ownership check for this project. Active security probing normally refuses to send any request until the target origin echoes a nonce placed at /.well-known/replay-qa-security-nonce, proving you control it; set this when the target is an app you deploy and that check is not workable. RESTRICTED: a request that sets this field from an account without the entitlement is rejected with a 403 (ask an admin to grant it). The waiver skips only the nonce fetch — a cloned/emulated target is still never probed, and only origins on the target site's own registrable domain are ever contacted.