> ## Documentation Index > Fetch the complete documentation index at: https://docs.canary.effectiveai.app/llms.txt > Use this file to discover all available pages before exploring further. # Create an app > Create an app: a catalog entry and a source repository whose `main` holds a starter app under `apps//`: an interface, a Python backend and tools. Clone `source.gitUrl` with your API key, commit your changes on a branch and push it. Build the bundle with `node apps//build-release.mjs`, upload it with `createAppReleaseUpload` and deploy it with `createAppDeployment`. The app serves nothing until its first deployment. You choose the ID, and it cannot change. When an Effective agent session inside a Mission Control creates the app, that Mission Control governs it and it is private to it; otherwise `visibility` decides who sees it. The response lists your permissions on the new app. 409 `app_exists` means the ID is taken, possibly by an app you cannot see or an archived one. If a response is lost, retry: 409 then means the app exists, and `getApp` returns it if you can open it. A scoped API key needs a grant to build all apps, since a grant on one app cannot cover an app that does not exist yet. ## OpenAPI ````yaml /openapi.json post /apps openapi: 3.0.3 info: title: Effective API version: 2.0.0 description: The public Effective REST API. Authenticate using an Effective API key. servers: - url: https://api.canary.effectiveai.app/api/v2 description: Canary security: - bearerAuth: [] paths: /apps: post: tags: - Apps summary: Create an app description: >- Create an app: a catalog entry and a source repository whose `main` holds a starter app under `apps//`: an interface, a Python backend and tools. Clone `source.gitUrl` with your API key, commit your changes on a branch and push it. Build the bundle with `node apps//build-release.mjs`, upload it with `createAppReleaseUpload` and deploy it with `createAppDeployment`. The app serves nothing until its first deployment. You choose the ID, and it cannot change. When an Effective agent session inside a Mission Control creates the app, that Mission Control governs it and it is private to it; otherwise `visibility` decides who sees it. The response lists your permissions on the new app. 409 `app_exists` means the ID is taken, possibly by an app you cannot see or an archived one. If a response is lost, retry: 409 then means the app exists, and `getApp` returns it if you can open it. A scoped API key needs a grant to build all apps, since a grant on one app cannot cover an app that does not exist yet. operationId: createApp requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/V2AppCreate' responses: '201': description: The new app. headers: Location: schema: type: string required: true content: application/json: schema: $ref: '#/components/schemas/V2App' '400': description: Invalid request, or invalid_app_id. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '401': description: Authentication required. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '403': description: >- You lack the permission this needs on the app, or are a read-only member. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '404': description: The Mission Control this request was made in was not found. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '409': description: 'app_exists: the ID is already in use in your organization.' content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '413': description: JSON request body exceeds 64 KiB. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '415': description: Content-Type must be application/json. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '500': description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '503': description: Temporarily unavailable; retry later. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' security: - bearerAuth: [] components: schemas: V2AppCreate: type: object properties: id: type: string maxLength: 63 pattern: ^app-[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$ description: >- App ID: `app-` followed by lowercase letters, digits and hyphens, ending in a letter or digit. It is part of the app’s hostname, so your organization’s subdomain and the ID together must fit 63 characters. title: type: string minLength: 1 maxLength: 120 description: Display title; defaults to the ID. description: type: string maxLength: 1000 description: Catalog description. iconEmoji: type: string minLength: 1 maxLength: 16 description: A single emoji, such as 📊. iconUrl: type: string maxLength: 2048 format: uri description: HTTPS URL of an icon image. visibility: type: string enum: - private - team description: >- Defaults to `team`. An app governed by a Mission Control is always `private`. required: - id additionalProperties: false V2App: type: object properties: id: type: string maxLength: 63 pattern: ^app-[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$ description: >- App ID: `app-` followed by lowercase letters, digits and hyphens, ending in a letter or digit. It is part of the app’s hostname, so your organization’s subdomain and the ID together must fit 63 characters. title: type: string description: Display title; the ID when no title was set. description: type: string nullable: true description: Catalog description, or null. iconEmoji: type: string nullable: true description: Emoji icon, or null. iconUrl: type: string nullable: true description: Icon image URL, or null. visibility: type: string enum: - private - team description: >- `team` lists the app for your organization; `private` lists it only for people granted access. public: type: boolean description: True when anyone with the link can open the app without signing in. managed: type: boolean description: >- True when the app was installed from the app store. A managed app has no source of its own and cannot be deployed from a bundle. currentDeploymentId: type: string nullable: true description: >- The deployment the app serves now, or null before its first deployment. url: type: string nullable: true format: uri description: >- Where the app’s interface opens, or null when it has no interface or no deployment yet. webUrl: type: string format: uri description: 'The app’s page in Effective: activity, access and settings.' source: type: object nullable: true properties: gitUrl: type: string format: uri description: >- HTTPS Git remote of the app’s source repository. Authenticate with your API key as the password; any username works. defaultBranch: type: string enum: - main description: >- The branch deployments are built on. You cannot push to it: push another branch and deploy it, which merges it here. required: - gitUrl - defaultBranch additionalProperties: false description: >- Where to clone and push the app’s source, when you have `build` permission; null otherwise and for an app installed from the app store. permissions: type: array items: type: string enum: - run - build - publish - manage description: >- `run` opens and uses the app, `build` changes its source, `publish` uploads release bundles and deploys them, `manage` changes its access and settings. description: >- What you can do with the app. Lists and reads include only apps you can `run`; a new app may lack it. required: - id - title - description - iconEmoji - iconUrl - visibility - public - managed - currentDeploymentId - url - webUrl - source - permissions additionalProperties: false V2CodedError: allOf: - $ref: '#/components/schemas/V2Error' - type: object properties: code: type: string minLength: 1 description: Stable error code. Clients must tolerate unknown future codes. details: type: array items: type: object properties: location: type: string enum: - path - query - header - body path: type: array items: type: string maxLength: 64 maxItems: 12 code: type: string enum: - required - invalid_type - invalid_value - unknown_field message: type: string minLength: 1 maxLength: 200 required: - location - path - code - message minItems: 1 maxItems: 20 description: Bounded safe validation issues; may omit some invalid fields. requestId: type: string minLength: 1 maxLength: 128 description: >- Existing server correlation for this HTTP attempt, when available. dataset: type: string enum: - naic - osha description: Dataset needed for dataset_not_enabled. businessCode: type: string description: The rater’s own refusal code, for business_rejection. violations: type: array items: type: object properties: code: type: string description: Authored or built-in constraint code message: type: string description: Authored message for the failed constraint path: type: string description: Input path of the offending value; empty for the request value: nullable: true description: Offending input value, size-bounded by the runtime constraint: type: string description: The constraint the value failed, as text cite: type: string nullable: true description: >- Filing citation of the constraint, when the source cites one required: - code - message - path - value - constraint - cite additionalProperties: false maxItems: 256 description: >- Each input constraint the submission failed, for invalid_inputs and business_rejection. violationsTruncated: type: boolean description: >- True when the rater reported more violations than violations holds. executionId: type: string description: >- The recorded execution of a failed rating, for rater rating failures. accessUrl: type: string nullable: true format: uri description: >- Where to add the product to your account, for product_access_required. required: - code V2Error: type: object properties: error: type: string minLength: 1 description: Human-readable explanation of the failure. required: - error securitySchemes: bearerAuth: type: http scheme: bearer description: 'Effective API key. Send Authorization: Bearer sk-eai-...' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.