API

HTTP API for projects, apps, and the rest of the platform.

Every resource you see in the dashboard has an HTTP endpoint. Use this from the CLI, CI, scripts, or any client that can send JSON.

• Base: https://api.nodion.com
• Interactive docs: api.nodion.com/v2/docs
• OpenAPI: api.nodion.com/v2/openapi.yaml

Authenticate

Send a bearer token on every request:

httpAuthorization: Bearer nodion_…

There are two kinds of token:

• Personal API keys (nodion_…) act as you. You choose scopes and can limit the key to specific projects. Create them under Account → Security. The token is shown once.
• Project keys (nodion_proj_…) belong to one project, not a person, so CI keeps working when someone leaves. Create them on the project’s API keys tab.

Scopes on a personal key:

• read: list and fetch resources
• write: create, update, and delete
• deploy: trigger deployments
• env:read / env:write: environment variable values
• logs:read: application logs

Reads need read, writes need write, unless an operation asks for a tighter scope (for example deploy). Project keys are not scoped. They can do anything in that project. Billing and 2FA stay in the dashboard; API keys cannot call those.

Pick a project

Nested routes look like /v2/projects/{id}/…. If you work in one project, use the short path and send the project id as a header:

httpX-Nodion-Project: prj_…

First request

bashcurl https://api.nodion.com/v2/applications \
  -H "Authorization: Bearer $NODION_TOKEN" \
  -H "X-Nodion-Project: $NODION_PROJECT"

Trigger a deploy (needs the deploy scope on a personal key):

bashcurl -X POST https://api.nodion.com/v2/applications/$APP_ID/deployments \
  -H "Authorization: Bearer $NODION_TOKEN"

Lists, errors, and limits

Collection responses look like{ "data": [ … ], "next_cursor": null }. Pass ?limit= and the previous next_cursoras ?cursor= to page.

Errors use RFC 9457 (application/problem+json) with a stablecode and a request_id. Quote that id to support. The public catalog is GET /v2/errors.

Key-authenticated calls are rate limited per account. Responses includeRateLimit-Limit, RateLimit-Remaining, andRateLimit-Reset. A 429 also sendsRetry-After. Every response has X-Request-Id.

For request bodies and a try-it console, use the interactive docs. The pages below are the same endpoints, in this site’s look.

Endpoints

Generated from the public OpenAPI document. 253 operations, grouped as in the spec.