Drive PocketBay from your own scripts

Step 1: Sign in to PocketBay, open your avatar menu (bottom-left) and create a token on the "API tokens" page. The token is shown in full only once — copy it right away.Step 2: Send the token in the Authorization header: Authorization: Bearer your-token.Step 3: Call any endpoint below. To see every open endpoint in a machine-readable form:

curl https://pocketbay.com/api/meta/capabilities

Example:

curl -H "Authorization: Bearer pb_xxx" https://pocketbay.com/api/projects

• ●List apps: GET /api/projects
• ●App details: GET /api/projects/{id}
• ●Version history: GET /api/projects/{id}/versions
• ●Deployment history: GET /api/projects/{id}/deployments
• ●Roll back to an eligible version: POST /api/projects/{id}/versions/{release_id}/rollback

Example:

curl -H "Authorization: Bearer pb_xxx" https://pocketbay.com/api/projects/123/deployments

• ●Upload source and deploy: POST /api/projects/{id}/deploy (multipart form; file is a zip, version/message optional)
• ●Redeploy the stored source: POST /api/projects/{id}/redeploy
• ●Check an in-flight deployment: GET /api/projects/{id}/deploy/status
• ●Stop an app: POST /api/projects/{id}/stop
• ●Wake or start an app: POST /api/projects/{id}/wake

Upload example:

curl -H "Authorization: Bearer pb_xxx" -F "file=@app.zip" https://pocketbay.com/api/projects/123/deploy

Two official ways to wake:(1) Account-level (the endpoint above) — good for scripts on your own machine.(2) Per-app key: generate it in the app's Advanced settings → "Scripted wake". It is bound to that one app and needs no account login — ideal for servers and cron jobs. A sleeping app auto-wakes for browser visits, but programmatic requests only get an empty 204 (with an X-Pocketbay-App-Status: sleeping header) and do NOT trigger a wake. Wake first, poll until running, then access:

curl -X POST -H "Authorization: Bearer pbw_your-key" https://your-app.pocketbay.app/.pocketbay/api/wake
curl -H "Authorization: Bearer pbw_your-key" https://your-app.pocketbay.app/.pocketbay/api/status

• ●Update app settings (name, env vars, etc.): PATCH /api/projects/{id}
• ●Delete an app (irreversible — use with care): DELETE /api/projects/{id}
• ●List/add custom domains: GET, POST /api/projects/{id}/domains
• ●Remove a domain: DELETE /api/projects/{id}/domains/{domain_id}
• ●Set primary domain: POST /api/projects/{id}/domains/{domain_id}/primary
• ●Check domain DNS: GET /api/projects/{id}/domains/{domain_id}/check-dns

Managed database:

• ●Provision: POST /api/projects/{id}/database/provision
• ●Reset password: POST /api/projects/{id}/database/reset-password
• ●List tables: GET /api/projects/{id}/database/tables
• ●Run a query: POST /api/projects/{id}/database/query
• ●List backups: GET /api/projects/{id}/database/backups

Exporting your data takes two steps (tickets are valid for 5 minutes; volume and database exports are limited to 3 per day each):

curl -X POST -H "Authorization: Bearer pb_xxx" -H "Content-Type: application/json" -d '{"kind":"volume"}' https://pocketbay.com/api/projects/123/export-tickets
curl -o data.tar.gz "https://pocketbay.com/api/projects/123/volume/export?ticket=the-ticket"

(For a database dump, use kind "database" and the /database/export download path.)

• ●Usage summary: GET /api/usage
• ●Metrics and traffic: GET /api/observability/overview and GET /api/observability/projects/{id}
• ●Credit balances: GET /api/billing/balances
• ●Ledger: GET /api/billing/ledger
• ●Current subscription: GET /api/billing/subscription

• ●Prefer not to call HTTP directly: the pocketbay CLI, MCP Server and GitHub deploys are covered in the "AI access" doc.
• ●Just ask Bayo: Bayo can query app status, metrics, logs and traffic for you; write actions show a confirmation card first.

• ●A token is as powerful as your account: never commit it to public repos, front-end code or chat logs. You can revoke tokens anytime in the console, which also shows each token's last-used time.
• ●Scope is limited to your own resources: endpoints only access apps and data owned by the signed-in user; admin and internal endpoints are not open.
• ●For a brand-new app, do the first upload via the web deploy page or the CLI; the open API is for day-to-day management and automation of existing apps.