Documentation menu

Apply batch

POSThttps://api.instacloud.com/projects/{projectId}/apply

Token scope: account · org · project — read-only tokens refused (not a GET).

Write a batch of user secrets, then redeploy the compute services those values reach, one deploy per service. Entries are reported written individually and services are reported deployed, started, skipped or failed individually, because the writes commit before the deploys run and a failed deploy never rolls a value back. skipDeploy writes without deploying. excludeFromDeploy drops services the caller is deploying itself; deployOnly names the services to deploy and ignores derivation, which is how a failed deploy is retried with no entries. A rename writes no env, so it deploys nothing on its own and needs no deploy grant — a batch that both renames and writes still deploys, for the write. Gated on what the body contains: secrets.write for any set or delete, service.rename for a rename, deploy only for what can actually deploy. A project-scoped entry is authorized against every branch, since that is where its value lands. Deploying a stopped service starts it. A suspended service is skipped instead of deployed: a deploy would invalidate the RAM snapshot suspension exists to preserve, so it is left untouched and reported with reason suspended.

Parameters

NameInTypeRequiredDescription
projectIdpathstringyes

Request body

application/json

FieldTypeRequiredDescription
branchstringnobranch name (default branch if omitted)
entriesobject[]yes
skipDeploybooleanno
excludeFromDeploystring[]no
deployOnlystring[]no

Responses

200

Default Response

FieldTypeRequiredDescription
entriesobject[]yes
entries.namestringyes
entries.writtenbooleanyes
servicesobject[]yes
services.serviceIdstringyes
services.result"deployed" | "started" | "skipped" | "failed"yes
services.reasonstringno

202

Default Response

FieldTypeRequiredDescription
status"approval_required"no
approvalIdstringno
actionstringnothe gated action, or a comma-joined compound set — prefer `actions`
actionsstring[]noevery capability this approval covers
messagestringno
urlstringnothe console page where a project admin reviews this request
nextActionsobject[]no
nextActions.opstringyesNeutral logical action id, e.g. "service.add" — NOT an operationId or a CLI/MCP tool name; each client maps it to its own surface.
nextActions.reasonstringyesNatural-language, human/LLM-facing "why do this now".
nextActions.argsobjectnoSuggested, flat named arguments; "<placeholder>"s where a value is unknown.
nextActions.gatedbooleannoTrue if the action passes a governance gate.

400

Default Response

FieldTypeRequiredDescription
errorstringyes

403

Default Response

FieldTypeRequiredDescription
errorstringyes

404

Default Response

FieldTypeRequiredDescription
errorstringyes

409

Default Response

FieldTypeRequiredDescription
errorstringyes

429

Default Response

FieldTypeRequiredDescription
errorstringyes

View as Markdown