$npx -y skills add inngest/inngest-skills --skill inngest-apiUse when the user explicitly asks for the Inngest REST API v2, raw HTTP, OpenAPI, API docs, API authentication, or an endpoint that the Inngest CLI does not expose. Covers api-docs.inngest.com, llms.txt, the OpenAPI v2 spec, Bearer authentication with API keys or signing keys, pr
| 1 | # Inngest REST API v2 |
| 2 | |
| 3 | Use this skill for raw REST API v2 work and API reference lookup. If the task |
| 4 | can be completed through `npx inngest-cli@latest api`, use `inngest-api-cli` |
| 5 | instead; the CLI is safer for agents because it handles target/auth flags and |
| 6 | endpoint command wiring. |
| 7 | |
| 8 | ## Prefer CLI First |
| 9 | |
| 10 | Use `inngest-api-cli` for: |
| 11 | |
| 12 | - Run and trace debugging from a run ID or event ID. |
| 13 | - Account, environment, key, webhook, app sync, and function invocation checks. |
| 14 | - Insights table/schema/query workflows. |
| 15 | - Local dev server or Cloud operational checks. |
| 16 | |
| 17 | Use raw REST API v2 only when: |
| 18 | |
| 19 | - The CLI does not expose the needed endpoint. |
| 20 | - The user explicitly asks for HTTP, curl, fetch, OpenAPI, or API docs. |
| 21 | - You need to inspect request/response schemas before deciding what to do. |
| 22 | |
| 23 | ## Docs Lookup |
| 24 | |
| 25 | When precision matters, fetch current docs instead of guessing: |
| 26 | |
| 27 | - API overview: `https://api-docs.inngest.com/` |
| 28 | - Authentication: `https://api-docs.inngest.com/authentication` |
| 29 | - LLM index: `https://api-docs.inngest.com/llms.txt` |
| 30 | - OpenAPI v2 spec: `https://api-docs.inngest.com/api-specs/v2.json` |
| 31 | - Markdown page pattern: add `.md` to a docs URL, for example |
| 32 | `https://api-docs.inngest.com/v2/runs/GetFunctionTrace.md` |
| 33 | - Endpoint request/response schemas: |
| 34 | [references/rest-api-v2.md](references/rest-api-v2.md) |
| 35 | |
| 36 | If a Markdown page returns an error or omits generated reference details, use |
| 37 | the OpenAPI spec for methods, paths, parameters, request bodies, and schemas. |
| 38 | |
| 39 | ## Base URLs |
| 40 | |
| 41 | - Cloud v2: `https://api.inngest.com/v2` |
| 42 | - Local dev server v2: `http://localhost:8288/api/v2` |
| 43 | - API docs say the dev server may also be reached through the local server |
| 44 | origin. Confirm the actual dev server port before making local requests. |
| 45 | |
| 46 | ## Authentication |
| 47 | |
| 48 | The REST API uses Bearer token authentication. |
| 49 | |
| 50 | - Prefer `INNGEST_API_KEY` for requests from CI, scripts, tools, and agents. |
| 51 | - Signing keys are primarily for apps communicating with Inngest; use them for |
| 52 | API requests only when that is the available, appropriate credential. |
| 53 | - API keys are for v2 endpoints only. |
| 54 | - Include `X-Inngest-Env` or use an environment-scoped API key when operating |
| 55 | outside the default production environment. |
| 56 | - Never paste, print, commit, or log API keys, event keys, signing keys, |
| 57 | webhook URLs, or decrypted secrets. |
| 58 | |
| 59 | Example: |
| 60 | |
| 61 | ```bash |
| 62 | curl -fsSL \ |
| 63 | -H "Authorization: Bearer $INNGEST_API_KEY" \ |
| 64 | -H "X-Inngest-Env: $INNGEST_ENV" \ |
| 65 | https://api.inngest.com/v2/account |
| 66 | ``` |
| 67 | |
| 68 | ## Endpoint Discovery |
| 69 | |
| 70 | Use the OpenAPI spec as the source of truth: |
| 71 | |
| 72 | ```bash |
| 73 | curl -fsSL https://api-docs.inngest.com/api-specs/v2.json |
| 74 | ``` |
| 75 | |
| 76 | Current v2 areas include account, environments, keys, webhooks, apps, function |
| 77 | invocation, event-run lookup, function runs, traces, Insights, and partner APIs. |
| 78 | Endpoint coverage can change, so inspect the spec before writing a raw request. |
| 79 | |
| 80 | For API-only or access-gated endpoints, such as partner-account endpoints, |
| 81 | confirm the user has the needed access before attempting a call. |
| 82 | |
| 83 | ## Request Rules |
| 84 | |
| 85 | - Derive method, path, query params, headers, and body from OpenAPI. |
| 86 | - Do not invent undocumented request fields. |
| 87 | - Use structured JSON parsing before making decisions from responses. |
| 88 | - Use body files or here-docs for complex JSON instead of shell-escaped one |
| 89 | liners. |
| 90 | - Add pagination cursors when `page.hasMore` is true and complete results are |
| 91 | needed. |
| 92 | - Treat missing `data` in list responses as an empty list unless an error is |
| 93 | present. |
| 94 | |
| 95 | ## Mutation Safety |
| 96 | |
| 97 | Read before write. Confirm target account, environment, resource, and intent |
| 98 | before raw HTTP mutations unless the user's instruction already makes all of |
| 99 | that explicit. |
| 100 | |
| 101 | Treat these categories as mutating or side-effecting: |
| 102 | |
| 103 | - Creating or patching environments. |
| 104 | - Creating webhooks. |
| 105 | - Syncing apps. |
| 106 | - Invoking functions. |
| 107 | - Partner account creation. |
| 108 | - Broad Insights queries that may be expensive or noisy. |
| 109 | |
| 110 | ## Output Handling |
| 111 | |
| 112 | - Summarize IDs, names, statuses, pagination, and actionable errors. |
| 113 | - Redact token values, webhook URLs, sensitive payload fields, and decrypted |
| 114 | secrets. |
| 115 | - Do not paste large raw traces, full OpenAPI fragments, or full response |
| 116 | bodies unless the user asks. |
| 117 | - If auth fails, first verify that a credential is present in the environment; |
| 118 | then ask the user to provide or rotate `INNGEST_API_KEY` without pasting it |
| 119 | into chat. |