Xyvenra docs

API reference

All examples use production host xyvenra.com. Platform API keys are live in production.

Platform API (user-scoped key)

A human must sign in, then create a key at https://xyvenra.com/app/keys. The plaintext secret is shown once. Prefix xyv_plat_. Early access limit: 60 requests per minute. Agents cannot complete signup or key creation in a browser.

# Status across Code, Cloud, Data, Mobile, and Studio
curl https://xyvenra.com/api/platform/v1/status \
  -H "Authorization: Bearer xyv_plat_..."

# Create a Cloud site
curl -X POST https://xyvenra.com/api/platform/v1/projects \
  -H "Authorization: Bearer xyv_plat_..." \
  -H "Content-Type: application/json" \
  -d '{"product":"cloud","name":"Launch site","slug":"launch-site"}'

# Create a Data project, Studio app, or Mobile starter
curl -X POST https://xyvenra.com/api/platform/v1/projects \
  -H "Authorization: Bearer xyv_plat_..." \
  -H "Content-Type: application/json" \
  -d '{"product":"data","name":"Launch checklist"}'

# List one product
curl "https://xyvenra.com/api/platform/v1/projects?product=studio" \
  -H "Authorization: Bearer xyv_plat_..."

Code has no server-side project. product: code on create returns an error and points at /app/code.

Remote MCP

POST /api/mcp accepts an OAuth 2.1 access token or the same platform Bearer token. Methods: initialize, tools/list, tools/call. Tools: create_project, list_projects, project, deploy, export, env_vars, database, files, eas_dispatch, guidance, and status. The connection guide is /docs/mcp. Official registry name: io.github.LAHutchins91/xyvenra, version 0.1.1. MCP OAuth 2.1 uses protected resource metadata, authorization server metadata, dynamic client registration, PKCE S256, scope xyvenra, and a consent screen that reuses GitHub or Google sign-in. OAuth tokens map to the same account as platform keys.

Cloud deploy

Platform deploy publishes self-contained HTML, or sends a saved Studio page when you pass projectId instead of html. A static-site ZIP still uses a Cloud deploy key on POST /api/cloud/v1/SITE_ID. Public env vars for that site are written into the page. Private values are not. Cloud is not a Node host.

Export

POST /api/platform/v1/export with {product, projectId} returns a Studio source ZIP, a Mobile Expo ZIP, or a Data JSON snapshot. The Mobile ZIP does not start an EAS build.

Data project key

curl "https://xyvenra.com/api/data/v1/PROJECT_ID/tasks/records?limit=50" \
  -H "Authorization: Bearer xyv_data_..."

curl -X POST "https://xyvenra.com/api/data/v1/PROJECT_ID/tasks/records" \
  -H "Authorization: Bearer xyv_data_..." \
  -H "Content-Type: application/json" \
  -d '{"title":"Ship docs","done":false}'

Platform keys can also create and edit records with POST /api/platform/v1/database, query with list_records, read one row with get_record, create a batch with records, poll with list_changes, delete a table with delete_table, and manage private files with POST /api/platform/v1/files. Field changes stay in the Data app. Project app-user auth, app-user record and file access, app-user table access, app-user private file writes, app-user record-event polls, app-user table-event polls, app-user file-event polls, app-user signed file URLs, app-user hook invocation, a public storage bucket, Realtime, and Edge Functions are not provisioned. Turning on app-user auth does not grant record, file, or table access. Turning on app-user auth, record and file access, table access, record-event polls, file-event polls, or hook invocation does not open private file writes. A table grant is not provisioned and is not project-wide. A file-write grant is not provisioned and is not project-wide. Record-event polls, table-event polls, and file-event polls do not open a websocket. Table-event polls are not provisioned, and data-app-hook is not invoked. Project-key event polls are not provisioned and do not open a websocket. An app session is not a project key, and that flag does not start event writers. No enable, apply, or deploy action is offered for them. Signed file URLs are not provisioned. They would expire and would not set a bucket public. App-user password changes are not provisioned. Turning on app-user auth does not open them. A project key is not an app session. No enable, apply, or deploy action is offered. App-user grant listings are not provisioned. Turning on app-user auth or access does not open them. A project key is not an app session. No enable, apply, or deploy action is offered. GET /api/data/v1/PROJECT_ID/capabilities reports that status and does not create them. project reads a Cloud page, Studio source, or Mobile draft, and can save Studio source or a Mobile draft. It does not publish a site.

Environment variables

The CLI accepts XYVENRA_API_KEY, XYVENRA_API_URL, and XYVENRA_CONFIG_DIR. Project env vars are stored for the owning account: GET, POST, PATCH, and DELETE /api/platform/v1/env. Pass product and, except for the Code workspace, projectId. Set exposure to public or secret. Cloud publish writes public values into the static page. Private values are not written there. There is no server runtime.

curl -X POST https://xyvenra.com/api/platform/v1/env \
  -H "Authorization: Bearer xyv_plat_..." \
  -H "Content-Type: application/json" \
  -d '{"product":"data","projectId":"PROJECT_ID","name":"PUBLIC_SITE_URL","value":"https://xyvenra.com/sites/launch-site"}'

Next step

guidance asks once when a project exists. The ask can include a Mobile Expo starter, a Data project, a Studio app, another Cloud site, a static deploy, and the MCP plugin, but only where that step exists. Decline turns a path off. continue creates only the step you name. It does not deploy or charge. Paid Cloud, Data, Mobile, and Studio plans are still coming soon.