> ## Documentation Index > Fetch the complete documentation index at: https://docs.canary.effectiveai.app/llms.txt > Use this file to discover all available pages before exploring further. # Deploy an app > Deploy an uploaded release bundle: squash-merge `sourceBranch` into the source repository’s `main`, deploy the bundle and make it the deployment the app serves. Returns the new deployment. `sourceBranch` must still be at `sourceSha`, and the bundle must have been uploaded for `sourceSha` with `createAppReleaseUpload`. The request waits for the deployment, which can take a minute. Each error code names how to recover. After 502 `deployment_failed`, the previous deployment is still current, but `main` already holds the merged source and the backend code or database migrations may already be updated: rebase `sourceBranch` onto `main`, rebuild, upload and deploy again. If a response is lost, check `listAppDeployments` before retrying. Needs `publish` permission on the app. Build from a branch you pushed to the app’s `source.gitUrl` (see `getApp`), authenticating with your API key. ## OpenAPI ````yaml /openapi.json post /apps/{appId}/deployments openapi: 3.0.3 info: title: Effective API version: 2.0.0 description: The public Effective REST API. Authenticate using an Effective API key. servers: - url: https://api.canary.effectiveai.app/api/v2 description: Canary security: - bearerAuth: [] paths: /apps/{appId}/deployments: post: tags: - Apps summary: Deploy an app description: >- Deploy an uploaded release bundle: squash-merge `sourceBranch` into the source repository’s `main`, deploy the bundle and make it the deployment the app serves. Returns the new deployment. `sourceBranch` must still be at `sourceSha`, and the bundle must have been uploaded for `sourceSha` with `createAppReleaseUpload`. The request waits for the deployment, which can take a minute. Each error code names how to recover. After 502 `deployment_failed`, the previous deployment is still current, but `main` already holds the merged source and the backend code or database migrations may already be updated: rebase `sourceBranch` onto `main`, rebuild, upload and deploy again. If a response is lost, check `listAppDeployments` before retrying. Needs `publish` permission on the app. Build from a branch you pushed to the app’s `source.gitUrl` (see `getApp`), authenticating with your API key. operationId: createAppDeployment parameters: - schema: type: string maxLength: 63 pattern: ^app-[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$ description: >- App ID: `app-` followed by lowercase letters, digits and hyphens, ending in a letter or digit. It is part of the app’s hostname, so your organization’s subdomain and the ID together must fit 63 characters. required: true description: >- App ID: `app-` followed by lowercase letters, digits and hyphens, ending in a letter or digit. It is part of the app’s hostname, so your organization’s subdomain and the ID together must fit 63 characters. name: appId in: path requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/V2AppDeploymentCreate' responses: '201': description: The deployment the app now serves. headers: Location: schema: type: string required: true content: application/json: schema: $ref: '#/components/schemas/V2AppDeployment' '400': description: >- Invalid request, invalid_source_branch, or invalid_release with the reason in details[0].message. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '401': description: Authentication required. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '403': description: >- You lack the permission this needs on the app, or are a read-only member. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '404': description: 'app_not_found: missing, archived, or not an app you can open.' content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '409': description: >- app_not_publishable, release_not_uploaded, source_branch_not_found, source_branch_changed, source_main_changed, source_merge_conflict or source_merge_refused; each names its recovery. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '413': description: JSON request body exceeds 64 KiB. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '415': description: Content-Type must be application/json. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '500': description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '502': description: >- deployment_failed: main holds the merged source but the deployment did not finish. details[0].message gives the reason when the runtime refused the release’s code or migrations. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' '503': description: Temporarily unavailable; retry later. content: application/json: schema: $ref: '#/components/schemas/V2CodedError' security: - bearerAuth: [] components: schemas: V2AppDeploymentCreate: type: object properties: bundleSha256: type: string pattern: ^[0-9a-f]{64}$ description: Lowercase hex SHA-256 of the release bundle file. sourceSha: type: string pattern: ^[0-9a-f]{7,64}$/i description: >- Commit of the app’s source repository that the bundle was built from. An upload is stored per commit and bundle. sourceBranch: type: string minLength: 1 maxLength: 255 description: >- Branch of the app’s source repository whose head is `sourceSha`. It cannot be `main`; deploying squash-merges it into `main`. message: type: string minLength: 1 maxLength: 500 description: Title of the commit on `main`; defaults to “Publish ”. required: - bundleSha256 - sourceSha - sourceBranch additionalProperties: false V2AppDeployment: type: object properties: id: type: string format: uuid description: Deployment ID. appId: type: string maxLength: 63 pattern: ^app-[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$ description: >- App ID: `app-` followed by lowercase letters, digits and hyphens, ending in a letter or digit. It is part of the app’s hostname, so your organization’s subdomain and the ID together must fit 63 characters. sha: type: string description: >- Commit on the source repository’s `main` branch that this deployment runs. shape: type: string nullable: true enum: - full - service - instructions - null description: >- What the release deploys: `full` an interface, backend and tools; `service` a backend and tools; `instructions` only agent instructions. Null when not recorded. bundleSha256: type: string nullable: true pattern: ^[0-9a-f]{64}$ description: SHA-256 of the release bundle, or null when not recorded. runtimeUrl: type: string nullable: true format: uri description: >- Base URL of the deployed backend, or null when the release deploys none or it was not recorded. mcpUrl: type: string nullable: true format: uri description: >- MCP endpoint of the deployed backend, or null when the release deploys none or it was not recorded. current: type: boolean description: True when the app serves this deployment now. publishedByEmail: type: string nullable: true description: Email of the member who deployed it, or null when not recorded. publishedAt: type: string format: date-time description: When it was deployed. required: - id - appId - sha - shape - bundleSha256 - runtimeUrl - mcpUrl - current - publishedByEmail - publishedAt additionalProperties: false V2CodedError: allOf: - $ref: '#/components/schemas/V2Error' - type: object properties: code: type: string minLength: 1 description: Stable error code. Clients must tolerate unknown future codes. details: type: array items: type: object properties: location: type: string enum: - path - query - header - body path: type: array items: type: string maxLength: 64 maxItems: 12 code: type: string enum: - required - invalid_type - invalid_value - unknown_field message: type: string minLength: 1 maxLength: 200 required: - location - path - code - message minItems: 1 maxItems: 20 description: Bounded safe validation issues; may omit some invalid fields. requestId: type: string minLength: 1 maxLength: 128 description: >- Existing server correlation for this HTTP attempt, when available. dataset: type: string enum: - naic - osha description: Dataset needed for dataset_not_enabled. businessCode: type: string description: The rater’s own refusal code, for business_rejection. violations: type: array items: type: object properties: code: type: string description: Authored or built-in constraint code message: type: string description: Authored message for the failed constraint path: type: string description: Input path of the offending value; empty for the request value: nullable: true description: Offending input value, size-bounded by the runtime constraint: type: string description: The constraint the value failed, as text cite: type: string nullable: true description: >- Filing citation of the constraint, when the source cites one required: - code - message - path - value - constraint - cite additionalProperties: false maxItems: 256 description: >- Each input constraint the submission failed, for invalid_inputs and business_rejection. violationsTruncated: type: boolean description: >- True when the rater reported more violations than violations holds. executionId: type: string description: >- The recorded execution of a failed rating, for rater rating failures. accessUrl: type: string nullable: true format: uri description: >- Where to add the product to your account, for product_access_required. required: - code V2Error: type: object properties: error: type: string minLength: 1 description: Human-readable explanation of the failure. required: - error securitySchemes: bearerAuth: type: http scheme: bearer description: 'Effective API key. Send Authorization: Bearer sk-eai-...' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.