Developers

Documentation for agents

Stackap is an application platform that provides deployment, runtime, PostgreSQL, storage, domains, HTTPS, cron jobs, secrets, logs, metrics, monitoring, backups and rollback through an agent-operable control plane.

Read this site as text

• /llms.txt: a short summary and an index of every page.
• /llms-full.txt: the full text of the site as Markdown.
• /sitemap.xml: every page and when it last changed.

These files are generated from the same pages people read, so the machine-readable and human versions cannot drift apart. If you find a difference, the page is wrong, and we want to know at hi@stackap.com.

The API describes itself

GET /v1/capabilities and GET /v1/openapi.json need no token. An agent that knows nothing about Stackap can call them to learn every route, the scope each one needs, the error codes and the error shape. They are generated from the server's own permission table, so they cannot drift from what the server enforces.

Authentication

Every API call carries Authorization: Bearer <token>. A token belongs to exactly one organization, and the organization is taken from the token and from nowhere else: an organization named in a request body, header or query string has no effect. A request for a resource in another organization returns the same response as a request for one that does not exist.

Routes that exist today

All routes are under /v1. This is a map, not a full reference: request and response shapes are not yet documented route by route, and until they are, the command-line tool is the better-specified way in.

A prompt you can hand to an agent

This is the prompt used on the get-started page. It points the agent at the plain-text docs and the public API description, states the rules, and lists the steps.

You are going to deploy an application to Stackap, a platform you operate through its command-line tool and HTTP API.

First read these, in order:
1. https://www.stackap.com/llms.txt
2. https://api.stackap.com/v1/capabilities  (every route, scope and error code; no token needed)

Rules:
- Never put a secret on a command line. Pass secrets on standard input (--stdin).
- If a deploy does not go live, read the build log and then the runtime log before changing any code.
- Ask me before deleting anything and before pointing a production domain at the server.
- If a call answers approval_required, tell me, wait for my decision, then repeat the identical request.

Task:
1. Log in:  stackap login --url https://api.stackap.com --token-stdin   (I will give you the token.)
2. Create a project:  stackap create my-app --name "My App"
3. Set each environment variable:  stackap env set my-app KEY --stdin
4. Deploy:  stackap deploy my-app
5. Read the result:  stackap logs my-app --source build
6. Tell me the live address and what you checked.

Operating rules for an agent

• Read the log before changing code. logs --source build and --source runtime say why a deploy did not go live.
• Treat rollback as code-only. It does not undo data.
• Never put a secret on a command line. Use --stdin.
• Ask a person before anything destructive, and before pointing a production domain.

Early-access scope

• The machine-readable description lists routes, scopes and errors but not request and response body schemas yet.
• No dedicated tool-protocol server.

Last updated 2026-10-03.