---
title: API
description: Authenticate to the Tori HTTP API, try it in the browser, and download the OpenAPI document.
---

The control plane answers at `https://api.tori.host`. Customer routes require a bearer token. Mint one in the console under Settings → API tokens, or use the token the CLI saves after sign-in (`TORI_TOKEN` in CI).

```
Authorization: Bearer <token>
```

Admin, enrollment, and zone-protocol endpoints are not part of the public documentation set.

## Interactive reference

The [API reference](/api/reference/) is a Scalar explorer of the public OpenAPI document generated from the server. Try-it-out calls `https://api.tori.host` from this origin. There is no documentation proxy; the token stays in this tab and is not written to localStorage. CORS allows `https://docs.tori.host`.

Pagefind indexes this overview and the representative operation page below. The Scalar panel is rendered in the browser and is not the search index.

## Representative operation

- [GET /api/apps](/api/list-apps/) — list the signed-in account's apps

## Task-oriented examples

Replace `<token>` with a secret from Settings → API tokens (or the token `tori login` saved). Replace `<slug>` with the app in `tori.json`. Request and response schemas live in the [interactive reference](/api/reference/); these examples do not repeat them.

List apps (`listApps`):

```sh
curl -sS -H "Authorization: Bearer <token>" \
  https://api.tori.host/api/apps
```

Show the signed-in account and plan (`getAccount`):

```sh
curl -sS -H "Authorization: Bearer <token>" \
  https://api.tori.host/api/account
```

List deploys (`listDeploys`):

```sh
curl -sS -H "Authorization: Bearer <token>" \
  https://api.tori.host/api/apps/<slug>/deploys
```

Read logs (`listLogs`) — ISO timestamps, maximum 24 hours, `limit` 1–500. Bounds must fall inside retention (`retentionDays` on the response; a `start` older than that is HTTP 410). Generate them rather than copying a calendar day:

```sh
start=$(date -u -v-15M +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d '15 minutes ago' +%Y-%m-%dT%H:%M:%SZ)
end=$(date -u +%Y-%m-%dT%H:%M:%SZ)
curl -sS -H "Authorization: Bearer <token>" \
  "https://api.tori.host/api/apps/<slug>/logs?start=${start}&end=${end}&limit=200"
```

Set a service environment variable (`setEnvVar`). On a service it applies on the next deploy. On a static app the API still stores the row; static deploys do not snapshot it:

```sh
curl -sS -X PUT -H "Authorization: Bearer <token>" \
  -H 'Content-Type: application/json' \
  -d '{"key":"API_TOKEN","value":"secret"}' \
  https://api.tori.host/api/apps/<slug>/env
```

Creating a static deploy is `POST /api/apps/{slug}/deploys` as `multipart/form-data` (`createDeploy`). A service deploy is the same path: JSON `{ "image": "registry/repo@sha256:…" }` for a digest you brought, or `multipart/form-data` with a source tarball for a Tori build. Prefer the CLI for those: it handles packing, digest checks, progress, and waiting until live. Try-it-out for the rest is on the [Scalar page](/api/reference/).

## Downloads

- [OpenAPI document](/downloads/openapi.public.json) (`openapi.public.json`)
- [Markdown sources](/downloads/markdown/)

Agents and scripts should prefer the Markdown and OpenAPI downloads over scraping the HTML.

Download this page as [Markdown](/downloads/markdown/api/index.md).