Skip to main content
The Runtime API gives you programmatic control of the same surfaces you use in the dashboard at app.runtm.com: cloud development sessions, prompts, deployments, organization templates, secrets, instructions, integrations, and real-time WebSockets. It is designed for:
  • Developers running Runtime from their terminal or local scripts to spin up cloud sessions
  • Coding agents (Claude Code, Cursor, Codex, etc.) that call the API to orchestrate sessions programmatically
  • CI/CD pipelines that build, deploy, and roll back applications
  • Internal tools and dashboards that read activity, manage secrets, or sync templates across orgs
Looking for guides? If you want patterns and walkthroughs instead of endpoint specs, see the Guides - covering authentication, session management, prompt streaming, file operations, telemetry, and best practices.
Prefer a CLI over raw HTTP? Install the runtm-api Go CLI for the hosted platform:
It wraps every endpoint on this page, emits JSON for AI agents to parse, and ships with embedded skill files for Claude Code, Cursor, and Codex.

​
Base URL

All endpoints share the same base URL:
This proxies to the backend’s canonical /api/* routes. For self-hosted instances where you call the backend directly, use https://your-host/api instead.

​
Quick start

1

Create an API key

Sign in at app.runtm.com, open Settings > API Keys, and click Create key. Choose a scope preset (e.g. Session automation) or pick custom scopes. The raw secret is shown once; copy it immediately.
You can also create keys via the dashboard while viewing an organization to scope the key to that org. See Authentication for the personal vs org distinction.
2

Verify the key

Confirm the key is valid and inspect its scopes:
See the Verify API key reference.
3

Make your first call

List the sessions the key can see:

​
Capability map

Use this map to find the right slice of the API for what you want to do.

Sessions

Create cloud development sessions, manage their lifecycle, send prompts, and stream agent output.

Deploy

Scaffold, validate, and ship sessions to production with streaming logs.

Templates

Manage organization templates, build snapshots, and the secrets they require.

Secrets

Personal and team secret stores. Values are write-only.

Context

System instructions, skills, MCP servers, docs, and knowledge sources that shape agent behavior.

Guardrails

Allowlists, deploy permissions, org limits, and cleanup policies.

Activity

Personal and team telemetry: prompts, usage, traces, and member breakdowns.

Integrations

GitHub App, GitHub user tokens, Linear, and Slack.

Provider Keys

Bring-your-own Anthropic and OpenAI keys, resolved key status, and current plan.

WebSockets

Real-time terminal, prompt streaming, and collaboration presence.

​
Foundations

Every endpoint page assumes you have read these short pages:

Authentication

How to send your API key and how the personal vs organization distinction works.

Scopes & Permissions

What each scope unlocks, role ceilings, and the legacy scope expansion table.

Errors & Rate Limits

Standard error shape, status codes, and the headers you should observe.

Conventions

Pagination, organization headers, datetimes, idempotency, and content types.

​
What is not covered

A few classes of endpoints exist in the platform but are intentionally absent from the API reference:
  • Dashboard-only routes. Anything that requires a browser session (e.g. some /api/keys mutations, billing portal redirects, GitHub App install flow) is not part of the programmatic surface.
  • Internal service-to-service routes. Frontend-to-backend authentication and platform proxy mechanics are not part of the customer surface.
  • Webhook receivers. Stripe, Slack events, Linear webhooks, GitHub App webhook callbacks, and similar inbound endpoints are platform infrastructure, not customer endpoints.
If you have a use case that is not covered, the team is happy to discuss it.