Skip to content
SupaCloud Docs
Select themeSelect language

`POST /api/apps/{id}/deploy` -- deploy an App at a route path.

POST
/api/apps/{id}/deploy
curl --request POST \
  --url https://example.com/api/apps/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/deploy \
  --header 'Content-Type: application/json' \
  --data '{ "access_mode": "example", "access_password": "example", "route_path": "example", "version": "example" }'

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
access_mode

Who may reach the App: org (default — workspace members), public (anyone), or password. Omitted ⇒ unchanged (a new deployment defaults to org). password requires access_password.

string | null
access_password

The shared password, for access_mode = "password". Stored only as an argon2 hash; never returned by any endpoint.

string | null
route_path
required
string
version
string | null
Examplegenerated
{
  "access_mode": "example",
  "access_password": "example",
  "route_path": "example",
  "version": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”
Media typeapplication/json

One deployment of an App within a workspace. The status column drives the lifecycle: draft -> deployed -> paused / undeployed. Only deployed status makes the route publicly accessible.

object
access_mode
required

Who may reach the deployed App: org (DEFAULT — an authenticated member of the deployment’s workspace), public (anyone, an explicit opt-in), or password (a shared password gate). Enforced at the serve path. The password itself is stored only as an argon2 hash and is never part of this model or any API response (read only by the serve-time verify).

string
app_id
required
string format: uuid
build_id

The build artifact this deployment serves (ADR 0030 W3-4 pointer swap). None for a plain App with no build; Some for a react/svelte App or after a rollback re-points to a prior build. Read by the public-route serving path (ADR 0041) to locate the dist/ artifact to serve.

string | null format: uuid
created_at
required
string format: date-time
deployed_at
string | null format: date-time
deployed_by
string | null format: uuid
error_page_config
id
required
string format: uuid
route_path
required
string
status
required
string
subdomain

Opaque per-deployment subdomain for separate-origin App hosting (supacloud#410 / ADR 0041). When set + the instance has an apps_base_domain, the App is served at <subdomain>.<apps_base_domain>. None ⇒ path-based /a/{ws}/{route} serving.

string | null
undeployed_at
string | null format: date-time
updated_at
required
string format: date-time
version
required
string
workspace_id
required
string format: uuid
Examplegenerated
{
  "access_mode": "example",
  "app_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "build_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "created_at": "2026-04-15T12:00:00Z",
  "deployed_at": "2026-04-15T12:00:00Z",
  "deployed_by": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "error_page_config": "example",
  "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "route_path": "example",
  "status": "example",
  "subdomain": "example",
  "undeployed_at": "2026-04-15T12:00:00Z",
  "updated_at": "2026-04-15T12:00:00Z",
  "version": "example",
  "workspace_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
}