Overview

Moondeck API (0.1.0)

The public /api/* surface of Moondeck Cloud.

Authenticate with a Moondeck session token (browser cookie, or Authorization: Bearer <jwt> from the mobile app) or a Moondeck API key (Authorization: Bearer <key>, for CLI / MCP / headless). Workspace-scoped API keys are rejected — use a user-scoped key.

Structured bodies use JSON unless an operation explicitly declares multipart, server-sent events or a binary response. Times are epoch milliseconds. IDs are ULIDs. Ordinary failures use { error: { code, message, details? } }; explicitly documented probe/media responses are exceptions.

The cloud does not persist or return env values, GitHub tokens, or AI provider keys. Env-value relay routes accept values only to forward them to a runner. project.env itself is a schema only.

Payload keys still say project. A repository is returned as { project: … } and a list as { projects: [...] }, and the schema components are named Project, ProjectResponse and so on. That is deliberate and it is part of the contract, not an oversight: the resource was renamed from project to repository, but renaming the JSON keys would break every existing client. The path moved; the payload did not. Error codes (PROJECT_NOT_FOUND, PROJECT_SLUG_TAKEN, PROJECT_READBACK_FAILED) are stable for the same reason.

Some operations are documented to endpoint depth only: the path, the authentication and the required permissions are accurate, and the request and response bodies are described as unconstrained JSON until that resource is detailed. Those operations say so in their own description.

The runner-bridge and agent-token surfaces are deliberately not described here.

• OpenAPI version: 3.1.0

Authentication

bearerAuth

A Moondeck session token (browser cookie, or a bearer JWT from the mobile app), or a Moondeck API key for CLI, MCP and headless clients.

API keys must be USER-scoped — a workspace-scoped key is refused with UNAUTHORIZED, because work here attributes to a person and such a key has none behind it.

API-key calls additionally require a plan that includes API access and answer PLAN_LIMIT otherwise; session-token calls are never gated that way. The same operation can therefore succeed in the app and return 402 from a script.

Key scopes are recorded and exposed to handlers but are NOT enforced yet: a key carries its user’s full access in whichever workspace the request names.

Security scheme type: http