Skip to content
SupaCloud Docs
Select themeSelect language

`POST /api/apps/{id}/runs` -- multipart submit. Authenticated by EITHER a logged-in session (the operator) OR a per-deployment App API token (`Authorization: Bearer scwa_…`, supacloud#410 — a server-side caller now that a hosted App on the separate content domain cannot ride the session). The token must own this `app_id`; the run is attributed to the App's deployer.

POST
/api/apps/{id}/runs
curl --request POST \
  --url https://example.com/api/apps/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/runs \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: multipart/form-data'

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

App id

Request Bodyrequired

Section titled “Request Bodyrequired”

One form field per manifest input; file-typed fields are streamed.

Media typemultipart/form-data
string

Responses

Section titled “Responses”

200

Section titled “200”

Run opened; uploads persisted.

Media typeapplication/json

Response body of POST /api/apps/{id}/runs — the run opened for the submit plus the metadata of every persisted file upload. Spec mirror of the JSON the submit_inner handler serializes ({ "run_id", "uploads": [...] }); the runtime builds the same shape via serde_json::json!, so this keeps the contract faithful without changing the runtime path.

object
run_id
required

The id of the app run opened for this submit (poll the runs API with it).

string format: uuid
uploads
required

One entry per persisted file-typed field, in submit order.

Array<object>

Wire-shape upload view returned by the upload HTTP endpoint – mirrors the row 1:1 with sha256 rendered as hex.

object
app_id
required
string format: uuid
expires_at
required
string format: date-time
field_name
required
string
id
required
string format: uuid
mime
required
string
original_filename
required
string
run_id
required
string format: uuid
sha256_hex
required
string
size_bytes
required
integer format: int64
storage_backend
required
string
uploaded_at
required
string format: date-time
workspace_id
required
string format: uuid
Examplegenerated
{
  "run_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "uploads": [
    {
      "app_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "expires_at": "2026-04-15T12:00:00Z",
      "field_name": "example",
      "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "mime": "example",
      "original_filename": "example",
      "run_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "sha256_hex": "example",
      "size_bytes": 1,
      "storage_backend": "example",
      "uploaded_at": "2026-04-15T12:00:00Z",
      "workspace_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
    }
  ]
}

400

Section titled “400”

Unknown/missing/duplicate field or malformed multipart body.

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

401

Section titled “401”

Missing/invalid App token or session.

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

403

Section titled “403”

App token does not authorize this app.

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

404

Section titled “404”

App not visible in this workspace.

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

413

Section titled “413”

A file field exceeds its size cap.

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

415

Section titled “415”

MIME-type mismatch on a file field.

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}

500

Section titled “500”

Storage I/O failure.

Media typeapplication/json

The canonical JSON body of every error response — the single source of truth the frontend binds to. Every AppError serializes as this exact shape, and the generated OpenAPI component ApiErrorBody (with its ErrorCode enum) is what the frontend error schema is generated from, so there is no hand-written error schema on either end.

object
code
required

Machine-readable, stable error code.

string
Allowed values: not_found unauthorized forbidden bad_request unprocessable precondition_failed conflict method_not_allowed rate_limited quota_exceeded database_error docker_error vault_error internal_error
details
One of:
null
error
required

Human-readable message (the server’s English text; the client may localize by code).

string
Example
{
  "code": "not_found"
}