# Koyeb > Koyeb is a developer-friendly serverless platform for deploying apps, databases, GPU workloads and > isolated code-execution sandboxes globally. The Koyeb REST API is a Swagger 2.0 contract generated from > protobuf services by grpc-gateway: 126 paths, 177 operations, 422 schemas, all under /v1, authenticated > with a single bearer token. Koyeb entered into a definitive agreement with Mistral AI in February 2026. Provenance: GENERATED by API Evangelist on 2026-08-17 from this repository's apis.yml and artifacts. Koyeb does not publish an llms.txt of its own — /llms.txt returns 404 on www.koyeb.com and on the docs host, and the HTTP 200 at https://app.koyeb.com/llms.txt is the Control Panel single-page-app HTML shell, not a document. ## Start here - [Koyeb API reference](https://www.koyeb.com/docs/reference/api): The API reference page, which embeds the published spec viewer. - [Published Swagger 2.0 contract](https://api.prod.koyeb.com/public.swagger.json): The machine-readable contract. Named by Koyeb's own reference page. Note the split: the spec is SERVED from api.prod.koyeb.com, the API is CALLED at https://app.koyeb.com. - [Create an API token](https://app.koyeb.com/user/settings/api): Mint the credential. Send it as `Authorization: Bearer `. - [Documentation home](https://www.koyeb.com/docs) - [Pricing](https://www.koyeb.com/pricing) - [Sign up](https://app.koyeb.com/auth/signup) ## Calling the API — the rules that are not in the spec - Base URL: `https://app.koyeb.com`, every path under `/v1`. - Auth: one personal API token, organization-wide, **no scopes and no read-only variant**. A token that can list services can also delete them and reveal every secret. - Env vars differ across Koyeb's own tooling: `KOYEB_API_TOKEN` (CLI, Agent Skills, SDKs) vs `KOYEB_TOKEN` (MCP server). - Rate limit: **400 requests per 60 seconds**, undocumented but advertised on every response as `x-ratelimit-limit: 400, 400;w=60` plus `x-ratelimit-remaining` and `x-ratelimit-reset` (seconds). No `Retry-After`. 429 is not declared in the spec. - Pagination: `limit` + `offset` query params; responses carry `limit`, `offset`, `count`, `has_next`. No cursors. - Partial updates: `PATCH` with an `update_mask` query parameter (google.protobuf.FieldMask), on 17 operations, shipped 2026-01-23. The `PUT` full-replace forms still exist alongside them and are not deprecated. - **No idempotency key.** Zero occurrences of "idempot" in the published spec. Retry a timed-out POST only after reconciling with a List-by-name call. - `dry_run=true` on CreateService / UpdateService / Compose validates without deploying. Closest thing to a safe rehearsal — there is no test mode and no test credentials. - Errors: `application/json` `{status, code, message}`, plus `fields[]` on 400. Not RFC 9457. - Events are **poll-only**: seven `*_events` collections. No webhooks, no AsyncAPI. ## Artifacts in this repository - [apis.yml](apis.yml): APIs.json index — 42 registered API entries, one per resource tag. - [openapi/](openapi/): 42 refined per-tag Swagger documents plus the full harvested contract at openapi/_original/koyeb-openapi.json. - [authentication/koyeb-authentication.yml](authentication/koyeb-authentication.yml): Token lifecycle, header format, observed 401 behaviour. - [conventions/koyeb-conventions.yml](conventions/koyeb-conventions.yml): Pagination, partial updates, error envelope, versioning, streaming, and the idempotency gap. - [errors/koyeb-problem-types.yml](errors/koyeb-problem-types.yml): Every declared 4xx/5xx with remediation. - [rate-limits/koyeb-rate-limits.yml](rate-limits/koyeb-rate-limits.yml): The probed 400/60s limit and its headers. - [plans/koyeb-plans-pricing.yml](plans/koyeb-plans-pricing.yml): Hobby / Pro $29 / Scale $299 / Enterprise, plus GPU, Postgres, storage and bandwidth rates. - [lifecycle/koyeb-lifecycle.yml](lifecycle/koyeb-lifecycle.yml): Versioning, SLA, status page, roadmap — and the missing deprecation policy. - [data-model/koyeb-data-model.yml](data-model/koyeb-data-model.yml): App → Service → Deployment → RegionalDeployment → Instance, with 70 resolved relationships. - [mcp/koyeb-mcp.yml](mcp/koyeb-mcp.yml): The MCP server — 15 tools, local stdio only. - [mcp/koyeb-tool-crosswalk.yml](mcp/koyeb-tool-crosswalk.yml): Each MCP tool bound to its backing operationId; 13 of 177 operations reachable. - [skills/_index.yml](skills/_index.yml): Koyeb's own 16 Agent Skills, saved verbatim. - [cli/koyeb-cli.yml](cli/koyeb-cli.yml): The CLI command surface — the most complete programmatic path. - [packages/koyeb-packages.yml](packages/koyeb-packages.yml): SDKs and providers with versions and release dates. - [conformance/koyeb-conformance.yml](conformance/koyeb-conformance.yml): Standards conformance with evidence. - [security/koyeb-trust-center.yml](security/koyeb-trust-center.yml): Vanta Trust Center, SOC 2 + ISO 27001. - [security/koyeb-domain-security.yml](security/koyeb-domain-security.yml): TLS, HSTS, DNSSEC, CAA, SPF, DMARC. - [well-known/koyeb-well-known.yml](well-known/koyeb-well-known.yml): The /.well-known/ probe — all misses, recorded. - [changelog/koyeb-changelog.yml](changelog/koyeb-changelog.yml): Recent dated releases. - [sandbox/koyeb-sandbox.yml](sandbox/koyeb-sandbox.yml): Console, free allowance, and why "Koyeb Sandboxes" is not an API test mode. - [components/koyeb-components.yml](components/koyeb-components.yml): The Deploy to Koyeb button and its parameters. - [overlays/](overlays/): OpenAPI Overlay 1.0.0 documents carrying our enhancements without mutating the originals. - [agentic-access/koyeb-agentic-access.yml](agentic-access/koyeb-agentic-access.yml): Recommended x-agentic-access execution contracts per operation. - [collections/](collections/): Postman and OpenCollection exports per API. ## Agent surfaces - [Koyeb Agent Skills](https://github.com/koyeb/koyeb-skills): 16 first-party skills in the Agent Skills open format, MIT licensed. The most capable agent path today — covers secrets, volumes, domains, databases and archives. - [Koyeb MCP server](https://github.com/koyeb/mcp-server-koyeb): `npx -y @koyeb/mcp-server`. Public beta, **local stdio only — there is no hosted endpoint an agent can POST to.** 15 tools covering 13 of 177 operations. - [Coding agents documentation](https://www.koyeb.com/docs/integrations/coding-agents) - No A2A agent card is served at `/.well-known/agent-card.json` or `/.well-known/agent.json` on any Koyeb host. ## SDKs, CLI and infrastructure-as-code - [@koyeb/api-client-js](https://www.npmjs.com/package/@koyeb/api-client-js): JavaScript SDK, 1.2.0 (2026-07-07). - [koyeb-sdk](https://pypi.org/project/koyeb-sdk/): Python SDK, 1.5.1 (2026-07-09). - [@koyeb/sandbox-sdk](https://www.npmjs.com/package/@koyeb/sandbox-sdk): Sandbox JS SDK, 1.0.9 (2026-02-25). - [koyeb-api-client-go](https://github.com/koyeb/koyeb-api-client-go): Go client, generated from the published Swagger; pseudo-versions only. - [Koyeb CLI](https://github.com/koyeb/koyeb-cli): v5.10.2 (2026-05-12). `brew install koyeb/tap/koyeb`. - [Terraform provider](https://registry.terraform.io/providers/koyeb/koyeb/latest): 0.1.11 (2024-12-12) — stale relative to the API. - [Pulumi provider](https://pypi.org/project/pulumi-koyeb/): 0.1.11 (2024-12-09) — stale relative to the API. - [Public Postman workspace](https://www.postman.com/gokoyeb/koyeb/collection/y5r00xu/koyeb-rest-api) ## Operations, legal and support - [Status page](https://status.koyeb.com/) — Instatus; machine-readable at /summary.json and /history.rss. - [Changelog](https://www.koyeb.com/changelog) — dated, roughly weekly, no RSS. - [Roadmap and feature requests](https://koyeb.canny.io/) - [Trust Center](https://trust.koyeb.com/) — Vanta; SOC 2 and ISO 27001 named on the pricing page. - [Service Level Agreement](https://www.koyeb.com/docs/legal/sla) — 99.9% (Scale), 99.99% (Enterprise). - [Master Service Agreement](https://www.koyeb.com/docs/legal/msa) - [Terms of Service](https://www.koyeb.com/docs/legal/terms) - [Data Processing Agreement](https://www.koyeb.com/docs/legal/data-processing-agreement) - [Community Slack](https://slack.koyeb.com/) · [Community forum](https://community.koyeb.com/) (member-only, behind Koyeb SSO) - [Blog](https://www.koyeb.com/blog) · [GitHub organization](https://github.com/koyeb) ## Known gaps - No `/.well-known/security.txt`, no published vulnerability-disclosure programme, and no `security@` address anywhere machine-readable — despite running a Vanta Trust Center. - No `/.well-known/api-catalog`, so nothing advertises the public Swagger document at a discoverable path. - No deprecation policy and no Sunset/Deprecation header support; superseded `PUT` operations are not marked deprecated. - No 429 declared in the contract even though the limit is enforced and advertised. - No webhooks and no AsyncAPI — you cannot be told a deployment went HEALTHY, only ask. - `app.koyeb.com` answers HTTP 200 with the Control Panel HTML shell for every unknown path, which breaks automated discovery against the API host.