Origin API

Origin is Cursor's code forge. Its public REST API lets apps and tools work with Origin repositories, commits, checks, pull requests, and app installations.

• Origin Apps authenticate with app JWTs and installation access tokens. See Authentication.
• View the full OpenAPI specification for detailed schemas and examples.
• Agents can load the llms.txt index or the complete reference as Markdown at llms-full.txt.

Overview

Origin apps implement an OAuth-style installation consent and GitHub App–style authentication model:

1. The app signs a short-lived EdDSA JWT with its Ed25519 private key.
2. The app exchanges that JWT and an installation ID for a short-lived installation access token (oit_…).
3. The installation token calls repository APIs and authenticates Git over HTTPS within the installation's approved repositories and scopes.
4. Origin sends signed webhook deliveries to the app's registered webhook URL.

Base URL

https://api.cursor.com/v1/origin

Endpoint paths in the reference include the full /v1/origin prefix.

Protocol conventions

Requests and responses use application/json. JSON field names are camelCase. Timestamps are RFC 3339 strings. Protobuf 64-bit integers, including pull request numbers and version numbers, are encoded as JSON strings.

Responses carry fields that sit at their default value rather than dropping them, so a false boolean, a 0 number, an empty string, and an empty array are all present in the body. Read the value itself instead of treating a missing key as the default. Fields documented as absent or omitted are optional in the contract and stay out of the body when they are unset.

Getting started

Origin access

• Browse Origin at cursor.com/codebase.
• Manage app settings at cursor.com/codebase/settings/apps.
• Generate an app signing key and register only the public key.

Origin CLI

Install the Origin CLI and sign in:

curl -fsSL https://downloads.cursor.com/origin/install.sh | shorigin auth login

Clone an existing repository:

origin repo clone '{ownerSlug}/{repoName}'# or use git directlygit clone 'https://origin.cursor.com/{ownerSlug}/{repoName}.git'

Apps clone using Git HTTPS authentication with an installation access token, not a user login.

Installation

Send a customer workspace admin to:

https://cursor.com/codebase/apps/install  ?client_id=APP_ID  &scope=SPACE_SEPARATED_SCOPES  &redirect_uri=REGISTERED_CALLBACK  &state=RANDOM_ANTI_FORGERY_VALUE  &summary=SHORT_REASON_FOR_ACCESS  &include_granted_scopes=true

The workspace admin chooses the target owner, approved scopes, and either all repositories or selected repositories. The customer, not the app, controls repository access.

After approval, Origin redirects to the registered callback:

https://ci.example.com/origin/callback?installation_receipt=RECEIPT_JWT

Verify the installation receipt, then store the installation ID from its sub claim. You need it whenever you mint an installation access token.

Installations use one of two repository-selection modes:

• all: the installation can access every repository owned by the selected target.
• selected: the installation can access only repositories selected by the workspace admin.

Both modes cover mirrored repositories as well as native Origin ones, so a mirror appears in GET /installation/repos and can be selected. A mirror is read-only until it becomes a stable outbound mirror: see Mirrored repositories.

Use GET /installation/repos with an installation token to discover the repositories available to that installation. App JWT endpoints can list, inspect, and delete the app's installations. Deleting an installation prevents new tokens from being minted.

Installation receipt

installation_receipt is a short-lived compact JWT signed by Origin. It proves the installation approval came from Origin rather than a forged redirect and carries everything the callback needs. Cursor refuses to redirect without one, so external callbacks always carry it.

JOSE header:

{  "alg": "EdDSA",  "kid": "origin-key-id",  "typ": "origin-installation-receipt+jwt"}

Claims:

{  "iss": "https://api.cursor.com/v1/origin",  "aud": "app_01...",  "sub": "i_01...",  "namespace_id": "ns_01...",  "iat": 1786465200,  "exp": 1786465500,  "jti": "RECEIPT_UUID",  "installedBy": {    "id": "user_01...",    "email": "installer@example.com",    "displayName": "Jane Doe"  },  "state": "ORIGINAL_VALUE"}

• aud is your app ID and sub is the installation ID to use when minting installation access tokens.
• namespace_id is the stable ID of the namespace the app was installed into.
• installedBy identifies the user who performed this install or re-consent. It describes the current action, so on a re-consent it can differ from the durable installedBy on Get App Installation. It carries displayName when the account has a name, and never carries handle; read the handle from a REST response or a webhook payload instead.
• Receipts expire five minutes after issuance. jti is unique per receipt.
• state is present only when the install URL carried a non-empty state, and echoes that value. Match it against the anti-forgery value you generated before redirecting.

Verify the receipt before trusting the callback: resolve the signing key from the JWKS by the kid header, require alg EdDSA and typ origin-installation-receipt+jwt, and validate the signature, iss, aud, and exp. Reject the callback when verification fails.

The receipt is not an installation access token. Never send it as a Bearer credential; mint installation tokens through Create Installation Access Token instead.

Authentication

Send REST credentials with the Bearer scheme. Each endpoint's Auth badges list the credential types it accepts:

curl --request GET \  --url https://api.cursor.com/v1/origin/repos/OWNER_SLUG/REPO_NAME \  --header "Authorization: Bearer $ORIGIN_BEARER_TOKEN"

Generate an app signing key

Origin Apps authenticate with an Ed25519 key pair. Generate the pair locally, then register only the public key at cursor.com/codebase/settings/apps. An app can hold up to 10 active signing keys.

Create a PKCS#8 private key and a PEM SPKI public key with OpenSSL:

openssl genpkey -algorithm ED25519 -out origin-app-private.pemopenssl pkey -in origin-app-private.pem -pubout -out origin-app-public.pem

The public key file starts with -----BEGIN PUBLIC KEY-----. Paste that PEM when you add a signing key. Use the matching private key only to sign app JWTs.

App JWT

Sign a short-lived JWT with the Ed25519 private key paired with one of the app's active signing keys. Generate that pair as described in Generate an app signing key.

JOSE header:

{  "alg": "EdDSA",  "kid": "app_01...",  "typ": "JWT"}

Claims:

{  "iss": "app_01...",  "aud": "origin-apps",  "iat": 1782928800,  "exp": 1782929100}

Set iss and kid to the app ID. Use a lifetime of approximately five minutes.

Authorization: Bearer APP_JWT

Use an app JWT for app-level operations such as reading app metadata, managing installations, minting installation tokens, and recovering webhook deliveries.

Installation access token

Call POST /app/installations/{installationId}/access_tokens with an app JWT. Installation tokens begin with oit_.

Authorization: Bearer oit_...

The response includes expiresAt. Mint tokens just in time, refresh them before expiration, treat them like passwords, and never log them.

Removing the installation, or deleting the app, invalidates its installation tokens before expiresAt. The REST API and Git over HTTPS then reject the token with 401. Do not retry with the same token; the app must be reinstalled before it can mint a working one.

An installation token cannot exceed the installation's approved scopes or repository access. You can attenuate a token to fewer scopes or repositoryIds. Empty or omitted arrays inherit the complete installation grant.

Use installation tokens for repository-scoped operations, including pull requests, check-run writes, and Git over HTTPS.

Git HTTPS authentication

Installation access tokens authenticate Git over HTTPS. The Git endpoint uses HTTP Basic authentication: the password is the installation token, and the username is x-access-token. Bearer credentials belong on the REST API; Git HTTPS rejects them.

Mint a token from Create Installation Access Token immediately before the Git operation. Tokens expire after at most 15 minutes.

Clone, fetch, and pull require repository:contents:read. Push requires repository:contents:write. The token must include the target repository in its grant.

Pushing also requires the repository's owner to be eligible to write to Origin, the same requirement Create Repo carries. A user owner must be on a Pro, Pro Student, Pro+, Ultra, or Start plan. A team owner must have an active paid team plan, must not be on Privacy Mode (Legacy), and must not have Origin turned off by a team admin. A push to a repository whose owner is ineligible returns 403. Clone, fetch, and pull do not carry this requirement.

Read cloneUrl from Get Repo or List App Installation Repositories. Both the GitHub-shaped path (https://origin.cursor.com/OWNER_SLUG/REPO_NAME.git) and the legacy /git/ path clone.

git clone "https://x-access-token:${INSTALLATION_TOKEN}@origin.cursor.com/OWNER_SLUG/REPO_NAME.git"

Embedding the token in the URL stores it in .git/config. After a successful clone, rewrite the remote so later commands do not reuse an expired secret:

git remote set-url origin "https://origin.cursor.com/OWNER_SLUG/REPO_NAME.git"

To keep the token out of the remote URL, supply it through Git's credential helper:

git -c credential.helper="!f() { echo username=x-access-token; echo password=${INSTALLATION_TOKEN}; }; f" \  clone "https://origin.cursor.com/OWNER_SLUG/REPO_NAME.git"

The Origin CLI credential helper is for user logins. App integrations pass the installation token as shown here. Treat the token like a password, never log it, and mint a fresh one before expiresAt when a job still needs Git access.

Git over HTTPS meters its own budget, separate from the REST budget in Rate limits. A charged Git response carries the same X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Used headers, with X-RateLimit-Resource set to git rather than core. Over-budget Git requests return 429 with Retry-After and X-RateLimit-Reset. Read the headers to pace a job rather than assuming a number; unmetered requests carry no rate-limit headers.

On a mirrored repository, an installation token clones, fetches, and pulls, and Origin rejects git push with 403 until the mirror becomes a stable outbound mirror. See Mirrored repositories.

User-authenticated CLI requests

Use origin api for user-authenticated requests. For an interactive session, sign in through your browser:

origin auth loginorigin api /repos/OWNER_SLUG/REPO_NAME/pulls

For a non-interactive session, provide a personal user API key from Cursor Dashboard → API Keys:

export CURSOR_API_KEY="YOUR_PERSONAL_USER_API_KEY"origin api /repos/OWNER_SLUG/REPO_NAME/pulls

The CLI exchanges the personal API key for a short-lived user access token, then sends that token in the Authorization header. Do not send the API key itself to an Origin endpoint. App integrations should use app JWTs and installation access tokens instead.

Discovery and signing keys

Origin publishes unauthenticated discovery metadata and its active signing keys. The same keys sign webhook deliveries and installation receipts.

Discovery metadata identifies the issuer and jwks_uri:

curl https://api.cursor.com/v1/origin/.well-known/openid-configuration

{  "issuer": "https://api.cursor.com/v1/origin",  "jwks_uri": "https://api.cursor.com/v1/origin/keys",  "response_types_supported": ["id_token"],  "subject_types_supported": ["public"],  "id_token_signing_alg_values_supported": ["EdDSA"]}

/keys returns active Ed25519 JWKs:

curl https://api.cursor.com/v1/origin/keys

{  "keys": [    {      "kty": "OKP",      "crv": "Ed25519",      "use": "sig",      "alg": "EdDSA",      "kid": "origin-key-id",      "x": "PUBLIC_KEY_MATERIAL"    }  ]}

Cache the JWKS. /keys sends Cache-Control: public, max-age=600, stale-if-error=600, so reuse a cached response for 10 minutes, then refresh; if a refresh fails, keep the last good keys for at most another 10 minutes before failing verification. Also refresh on a signature that no key verifies, which drops a retired key ID. Keys rotate weekly.

Webhook signatures do not carry a key ID, so verification should try each active Ed25519 key. Installation receipts carry the signing key's kid in their JOSE header, so receipt verification can resolve the key directly.

Scopes

Request only the minimum scopes your app needs. repository:metadata:read and app or installation metadata access are granted automatically and should not be added separately to installation URLs.

Requesting a :write scope also grants the matching :read scope, so repository:labels:write covers repository:labels:read and you do not have to list both. The reverse does not hold: a read scope never grants writes.

The installation token can only narrow these grants. It cannot add a scope or repository the workspace admin did not approve.

Mirror-state changes sit outside this table. Transition Repo Mirror, Force Repo Mirror Cutover, and Detach Repo Mirror take repository:mirror:write or repository:mirror:delete, which an app cannot request at installation: they are carried by a Cursor user credential, and the caller must also administer the repository on the mirror's upstream source.

Installation management sits outside it too. Add App Installation Repositories takes namespace:installations:write, which an app cannot request at installation: a namespace admin holds it on a Cursor user credential, and the same credential kind that consented to the installation is the one that can extend it.

App management sits outside it for the same reason. Create App takes namespace:apps:create, List Namespace Apps and Get App take namespace:apps:read, and Update App, Add App Signing Key, and Revoke App Signing Key take app:settings:write. A publisher holds these on a Cursor user credential; an app cannot request them for itself.

The table covers the scopes an app requests at installation. To look up the scope a single operation requires, read its x-origin-scopes extension in the OpenAPI specification. That extension covers every operation, including the app, installation, and namespace scopes that come with the credential itself rather than from an installation grant. An operation whose scopes all come with the credential marks its extension ambient: true: there is nothing to request for it, and presenting the right credential is enough.

Mirrored repositories

An installation uses every scope it holds on a native Origin repository and on a stable outbound mirror. On a repository in any other mirror state, only two scopes apply:

• repository:metadata:read
• repository:contents:read

Every other scope returns 403 on that repository, whatever the workspace admin approved. Over the REST API, repository and contents reads, commit comparison, and Sync Mirror keep working, and Origin rejects pull requests, reviews, comments, checks, rulesets, and every write. Over Git HTTPS, clone, fetch, pull, and LFS download keep working, and Origin rejects push and LFS upload.

Moving a repository out of that state is a user-credential operation rather than something an installation can do: Transition Repo Mirror advances the mirror direction, Force Repo Mirror Cutover cuts over to the upstream source without pushing divergent refs back, and Detach Repo Mirror disconnects the mirror for good.

The mirror object on a repository does not tell you whether writes are allowed. A mirror partway through a transition can report mirror.status as outbound and still be read-only, so treat the 403 as authoritative rather than branching on mirror.status.

Rate limits

The Origin API uses a shared per-principal point budget that resets on a rolling one-minute window. Each authenticated principal kind has its own budget:

Every endpoint charges a fixed cost against that budget before the handler runs. Authentication and authorization failures are not charged.

Cursor can raise per-app minute budgets for design partners. Contact Cursor if your integration needs a higher limit.

Response headers

Charged responses and Get Rate Limit include:

X-RateLimit-Reset advertises a full 60-second window from the response time. The counter's window starts at the first charged request in a burst, not on a calendar-minute boundary.

Exceeding the limit

When a request would exceed the budget, the API returns HTTP 429 with:

• Retry-After: seconds to wait before retrying (60)
• The same X-RateLimit-* headers, with X-RateLimit-Remaining set to 0

{  "code": 8,  "message": "Rate limit exceeded: 3000 points per minute for this installation. Retry after 60s.",  "details": []}

Wait for Retry-After, or until X-RateLimit-Reset, before retrying. Use backoff with jitter when concurrent callers share one installation token.

Checking remaining quota

Call Get Rate Limit to read the current budget without consuming points. The response body mirrors the X-RateLimit-* headers for the shared core resource.

Common conventions

Pagination

Paginated endpoints accept:

• pageSize: defaults to 30 and is capped at 100.
• pageToken: opaque token returned by the preceding page. Do not inspect or construct it.

Responses use a resource-specific collection field and nextPageToken. It is empty when no next page exists. Public list responses do not include total counts. Page tokens are bound to their originating resource and filters. Restart pagination when filters change. Invalid or mismatched non-empty tokens return 400.

Errors

Errors use a Google RPC-style body:

{  "code": 5,  "message": "resource not found",  "details": []}

Common HTTP statuses are 400, 401, 403, 404, 429, 500, and 503. Some Git-database operations also return 409 for repository-state conflicts. See Rate limits for 429 headers and retry behavior.

Use the HTTP status and code to branch on errors. Treat message as developer-facing text.

A 404 never distinguishes a resource that does not exist from one your app cannot reach. Read it as "not available to this installation" rather than as proof the resource is absent.

details carries typed entries: google.rpc.BadRequest field violations on an invalid argument, and a google.rpc.RequestInfo entry on every error. Origin can add detail types at any time, so ignore entries your integration does not recognize.

Every error response carries the request ID twice: in an X-Request-ID response header, and as a google.rpc.RequestInfo entry in details. Origin echoes the x-request-id you sent, or generates one when you send none. The RequestInfo entry is present even when message is an opaque internal error, so quote the request ID when you contact Cursor about a failed call.

Unmatched paths under /v1/origin, and requests that use the wrong method on a known path, return this same body rather than a generic router error. The message names the method and path and never echoes the query string.

Repository paths

Repository-scoped paths take the owner slug and repository name as {ownerSlug}/{repoName}. Both segments resolve case-insensitively, so any casing addresses the repository. Responses return the stored name and slug rather than the casing you sent, and Git HTTPS URLs resolve the same way. Compare repository names case-insensitively, and read the canonical casing from Get Repo.

Every repository-scoped path also accepts the repository's stable ID in place of the pair: send _ as the owner slug and the ID as the repository name, as in GET /v1/origin/repos/_/REPO_ID. Read the ID from the id field on Get Repo. The sentinel _ cannot be claimed as an owner slug, so the two forms never collide. In a Connect or JSON request, set ownerSlug to _ and name to the ID.

The ID form survives a rename, which makes it the stable way to address a repository. It grants nothing on its own: after Origin resolves the ID to a repository, your app still needs the same scope on that repository. An ID your app cannot reach returns the same 404 body as an ID that does not exist, so a response never confirms that a repository exists. A malformed ID returns 400. Create Repo takes an owner slug alone and rejects _.

Resource references

Resource snapshots contain the resource's current fields. Container context uses compact references instead of duplicating complete resources:

• RepositoryReference identifies a repository.
• PullRequestReference identifies a pull request and nests its repository reference.
• ThreadReference identifies the thread containing a pull request comment.
• OriginActor identifies a public actor as one of user, app, or serviceAccount. Exactly one variant is present; read the identity from that variant.

Current limitations

• Namespace-wide repository listing and repository creation are not part of the partner API. Discover repositories through the installation.
• Commit comparison returns summary data rather than an embedded commit list. Changed files have their own paginated endpoint, List Comparison Files.
• Threads are addressable only for resolution. There is no endpoint that lists threads directly; read them from the comments they contain.
• Push webhooks do not include a complete commit list.
• Pull request merge supports native Origin repositories. Mirrored repositories are rejected.
• A mirrored repository is read-only for an installation until it becomes a stable outbound mirror. See Mirrored repositories.

Implementation checklist

• Store the Ed25519 private key in a secrets manager and rotate keys deliberately. See Generate an app signing key.
• Verify the installation receipt on install callbacks and read the installation ID and state from its claims.
• Use short-lived app JWTs and mint installation tokens just in time.
• Use installation tokens, not app JWTs, for repository-scoped APIs, check-run writes, and Git HTTPS.
• Request the minimum scopes and repository access.
• Treat page tokens as opaque and restart pagination when filters change.
• Keep check key values stable and readable. Use a new immutable externalId for each retry and increasing externalUpdatedAt values for updates.
• Verify webhook signatures against the raw request body before parsing.
• Deduplicate deliveries with webhook-id and process asynchronously after returning 2xx.
• Ignore unknown JSON fields for forward compatibility.
• Honor Retry-After and X-RateLimit-* headers. Use Get Rate Limit to monitor remaining points without consuming them.

Endpoint reference

Download the OpenAPI specification for the complete component schemas. The document declares https://api.cursor.com as its server and a bearerAuth HTTP bearer security scheme, and each operation lists the response codes that operation can return, plus a request and response example. Every operation also carries an x-origin-scopes extension: scopes holds the scope the operation requires, and tokenTypes holds the credential kinds it accepts. Path parameters carry the same names the URLs use, ownerSlug and repoName. Every operation carries a unique operationId; where one operation answers two URL shapes, the second shape's id takes a _2 suffix, as in OriginService_GetRepoTarball_2.

The JSON snippets show schema-shaped placeholder values. Response field descriptions reflect the OpenAPI schema and current platform contract.

Apps and installations

curl --request GET \  --url 'https://api.cursor.com/v1/origin/rate_limit' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

{  "resources": {    "core": {      "limit": 6000,      "remaining": 5994,      "reset": 1785682800,      "used": 6    }  },  "rate": {    "limit": 6000,    "remaining": 5994,    "reset": 1785682800,    "used": 6  }}

curl --request GET \  --url 'https://api.cursor.com/v1/origin/app' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

{  "id": "app_01k2ja2000e0080000000000a1",  "displayName": "CI Status Bot",  "webhookUrl": "https://ci.acme.dev/webhooks/origin",  "events": [    "pull_request.created",    "pull_request.merged"  ],  "createdAt": "2026-08-01T09:30:00Z",  "updatedAt": "2026-08-02T14:45:00Z",  "installationRedirectUris": [    "https://ci.acme.dev/origin/setup"  ],  "namespaceSlug": "acme",  "description": "Posts CI status on pull requests.",  "websiteUrl": "https://ci.acme.dev",  "defaultScopes": [    "repository:contents:read",    "repository:pull_requests:read"  ]}

curl --request GET \  --url 'https://api.cursor.com/v1/origin/app/installations' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

{  "installations": [    {      "id": "inst_01k2ja2000e0080000000000b2",      "appId": "app_01k2ja2000e0080000000000a1",      "target": {        "slug": "acme",        "id": "ns_01k2ja2000e0080000000000p3",        "type": "team"      },      "createdAt": "2026-08-01T09:30:00Z",      "updatedAt": "2026-08-02T14:45:00Z",      "repoSelectionMode": "selected",      "scopes": [        "repository:contents:read",        "repository:pull_requests:read"      ]    }  ]}

curl --request GET \  --url 'https://api.cursor.com/v1/origin/app/installations/INSTALLATION_ID' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

{  "id": "inst_01k2ja2000e0080000000000b2",  "appId": "app_01k2ja2000e0080000000000a1",  "target": {    "slug": "acme",    "id": "ns_01k2ja2000e0080000000000p3",    "type": "team"  },  "createdAt": "2026-08-01T09:30:00Z",  "updatedAt": "2026-08-02T14:45:00Z",  "repoSelectionMode": "selected",  "scopes": [    "repository:contents:read",    "repository:pull_requests:read"  ]}

curl --request DELETE \  --url 'https://api.cursor.com/v1/origin/app/installations/INSTALLATION_ID' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

204 No Content

curl --request POST \  --url 'https://api.cursor.com/v1/origin/app/installations/INSTALLATION_ID/access_tokens' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN' \  --header 'Content-Type: application/json' \  --data '{  "scopes": [    "repository:contents:read",    "repository:pull_requests:read"  ],  "repositoryIds": [    "repo_01k2ja2000e0080000000000q4"  ]}'

{  "token": "oit_2v8xkq4m1c7p9t3w5y0z6r4b",  "expiresAt": "2026-08-01T10:30:00Z"}

curl --request GET \  --url 'https://api.cursor.com/v1/origin/installation/repos' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

{  "repositories": [    {      "id": "repo_01k2ja2000e0080000000000q4",      "name": "rocket",      "fullName": "acme/rocket",      "owner": {        "slug": "acme",        "id": "ns_01k2ja2000e0080000000000p3",        "type": "team"      },      "defaultBranch": "main",      "createdAt": "2026-08-01T09:30:00Z",      "updatedAt": "2026-08-02T14:45:00Z",      "pushedAt": "2026-08-02T14:45:00Z",      "cloneUrl": "https://origin.cursor.com/git/acme/rocket.git"    }  ],  "repoSelectionMode": "selected"}

curl --request GET \  --url 'https://api.cursor.com/v1/origin/app/webhook/deliveries' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

{  "deliveries": [    {      "id": "whd_01k2ja2000e0080000000000j9",      "event": {        "id": "evt_01k2ja2000e0080000000000r5",        "type": "pull_request.created"      },      "installation": {        "id": "inst_01k2ja2000e0080000000000b2",        "target": {          "slug": "acme",          "id": "ns_01k2ja2000e0080000000000p3",          "type": "team"        }      },      "createdAt": "2026-08-01T09:30:00Z",      "deliveredAt": "2026-08-02T14:45:05Z",      "lastAttempt": {        "id": "wha_01k2ja2000e0080000000000k0",        "deliveryId": "whd_01k2ja2000e0080000000000j9",        "trigger": "automatic",        "responseStatusCode": 200,        "latencyMs": 182,        "attemptedAt": "2026-08-02T14:45:05Z"      }    }  ]}

curl --request POST \  --url 'https://api.cursor.com/v1/origin/app/webhook/deliveries:batchRedeliver' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN' \  --header 'Content-Type: application/json' \  --data '{  "deliveryIds": [    "whd_01k2ja2000e0080000000000j9"  ]}'

{  "results": [    {      "deliveryId": "whd_01k2ja2000e0080000000000j9",      "outcome": "queued"    }  ]}

curl --request POST \  --url 'https://api.cursor.com/v1/origin/app/webhook/pings' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN' \  --header 'Content-Type: application/json' \  --data '{}'

{  "deliveryId": "whd_01k2ja2000e0080000000000j9",  "eventId": "evt_01k2ja2000e0080000000000r5",  "delivered": true,  "responseStatusCode": 200}

curl --request GET \  --url 'https://api.cursor.com/v1/origin/apps/{appId}' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

{  "id": "app_01k2ja2000e0080000000000a1",  "displayName": "CI Status Bot",  "webhookUrl": "https://ci.acme.dev/webhooks/origin",  "events": [    "pull_request.created",    "pull_request.merged"  ],  "createdAt": "2026-08-01T09:30:00Z",  "updatedAt": "2026-08-02T14:45:00Z",  "installationRedirectUris": [    "https://ci.acme.dev/origin/setup"  ],  "namespaceSlug": "acme",  "description": "Posts CI status on pull requests.",  "websiteUrl": "https://ci.acme.dev",  "defaultScopes": [    "repository:contents:read",    "repository:pull_requests:read"  ]}

curl --request PATCH \  --url 'https://api.cursor.com/v1/origin/apps/APP_ID' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN' \  --header 'Content-Type: application/json' \  --data '{  "webhookUrl": "https://ci.acme.dev/webhooks/origin-v2",  "events": {    "events": [      "pull_request.created",      "pull_request.merged",      "repository.pushed"    ]  }}'

{  "id": "app_01k2ja2000e0080000000000a1",  "displayName": "CI Status Bot",  "webhookUrl": "https://ci.acme.dev/webhooks/origin-v2",  "events": [    "pull_request.created",    "pull_request.merged",    "repository.pushed"  ],  "createdAt": "2026-08-01T09:30:00Z",  "updatedAt": "2026-08-02T14:45:00Z",  "installationRedirectUris": [    "https://ci.acme.dev/origin/setup"  ],  "namespaceSlug": "acme",  "description": "Posts CI status on pull requests.",  "websiteUrl": "https://ci.acme.dev",  "defaultScopes": [    "repository:contents:read",    "repository:pull_requests:read"  ]}

curl --request POST \  --url 'https://api.cursor.com/v1/origin/apps/APP_ID/signing_keys' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN' \  --header 'Content-Type: application/json' \  --data '{  "publicKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAq9zTf3hL6wXe1cVj0bYs5mKR8uDnG2oAaPp4NiEkKlM=\n-----END PUBLIC KEY-----"}'

{  "kid": "3q2xW9dK5fJm8vB1nY6cT0aZrQpLh4eGkVsN7uMxOdI",  "createdAt": "2026-08-02T14:45:00Z"}

curl --request DELETE \  --url 'https://api.cursor.com/v1/origin/apps/{appId}/signing_keys/{kid}' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

204 No Content

curl --request GET \  --url 'https://api.cursor.com/v1/origin/namespaces/{namespaceSlug}/apps' \  --header 'Authorization: Bearer YOUR_ORIGIN_TOKEN'

{  "apps": [    {      "id": "app_01k2ja2000e0080000000000a1",      "displayName": "CI Status Bot",      "description": "Posts CI status on pull requests."    },    {      "id": "app_01k2ja2000e0080000000000a2",      "displayName": "Deploy Bot",      "description": ""    }  ],