inngest-api

Inngest REST API v2

For Cloud operations with connected MCP tools, use inngest-cloud first.
Keep this skill for explicit terminal/HTTP work or a capability missing from
MCP. Do not ask for an API key when OAuth MCP can complete the task.

Use this skill for raw REST API v2 work and API reference lookup. If the task
can be completed through npx inngest-cli@latest api, use inngest-api-cli
instead; the CLI is safer for agents because it handles target/auth flags and
endpoint command wiring.

Prefer CLI First

Use inngest-api-cli for:

• Run and trace debugging from a run ID or event ID.
• Account, environment, key, webhook, app sync, and function invocation checks.
• Insights table/schema/query workflows.
• Local dev server or Cloud operational checks.

Use raw REST API v2 only when:

• The CLI does not expose the needed endpoint.
• The user explicitly asks for HTTP, curl, fetch, OpenAPI, or API docs.
• You need to inspect request/response schemas before deciding what to do.

Docs Lookup

When precision matters, fetch current docs instead of guessing:

• API overview: https://api-docs.inngest.com/
• Authentication: https://api-docs.inngest.com/authentication
• LLM index: https://api-docs.inngest.com/llms.txt
• OpenAPI v2 spec: https://api-docs.inngest.com/api-specs/v2.json
• Markdown page pattern: add .md to a docs URL, for example
  https://api-docs.inngest.com/v2/runs/GetFunctionTrace.md
• Endpoint request/response schemas:
  references/rest-api-v2.md

If a Markdown page returns an error or omits generated reference details, use
the OpenAPI spec for methods, paths, parameters, request bodies, and schemas.

Base URLs

• Cloud v2: https://api.inngest.com/v2
• Local dev server v2: http://localhost:8288/api/v2
• API docs say the dev server may also be reached through the local server
  origin. Confirm the actual dev server port before making local requests.

Authentication

The REST API uses Bearer token authentication.

• Prefer INNGEST_API_KEY for requests from CI, scripts, tools, and agents.
• Signing keys are primarily for apps communicating with Inngest; use them for
  API requests only when that is the available, appropriate credential.
• API keys are for v2 endpoints only.
• Include X-Inngest-Env or use an environment-scoped API key when operating
  outside the default production environment.
• Never paste, print, commit, or log API keys, event keys, signing keys,
  webhook URLs, or decrypted secrets.

Example:

curl -fsSL \
  -H "Authorization: Bearer $INNGEST_API_KEY" \
  -H "X-Inngest-Env: $INNGEST_ENV" \
  https://api.inngest.com/v2/account

Endpoint Discovery

Use the OpenAPI spec as the source of truth:

curl -fsSL https://api-docs.inngest.com/api-specs/v2.json

Current v2 areas include account, environments, keys, webhooks, apps, function
invocation, event-run lookup, function runs, traces, Insights, and partner APIs.
Endpoint coverage can change, so inspect the spec before writing a raw request.

For API-only or access-gated endpoints, such as partner-account endpoints,
confirm the user has the needed access before attempting a call.

Request Rules

• Derive method, path, query params, headers, and body from OpenAPI.
• Do not invent undocumented request fields.
• Use structured JSON parsing before making decisions from responses.
• Use body files or here-docs for complex JSON instead of shell-escaped one
  liners.
• Add pagination cursors when page.hasMore is true and complete results are
  needed.
• Treat missing data in list responses as an empty list unless an error is
  present.

Mutation Safety

Read before write. Confirm target account, environment, resource, and intent
before raw HTTP mutations unless the user's instruction already makes all of
that explicit.

Treat these categories as mutating or side-effecting:

• Creating or patching environments.
• Creating webhooks.
• Syncing apps.
• Invoking functions.
• Partner account creation.
• Broad Insights queries that may be expensive or noisy.

Output Handling

• Summarize IDs, names, statuses, pagination, and actionable errors.
• Redact token values, webhook URLs, sensitive payload fields, and decrypted
  secrets.
• Do not paste large raw traces, full OpenAPI fragments, or full response
  bodies unless the user asks.
• If auth fails, first verify that a credential is present in the environment;
  then ask the user to provide or rotate INNGEST_API_KEY without pasting it
  into chat.