inngest-api

Inngest REST API v2

For Cloud operations with connected MCP tools, use inngest-cloud first. Keep this skill for explicit terminal/HTTP work or a capability missing from MCP. Do not ask for an API key when OAuth MCP can complete the task.

Use this skill for raw REST API v2 work and API reference lookup. If the task can be completed through npx inngest-cli@latest api, use inngest-api-cli instead; the CLI is safer for agents because it handles target/auth flags and endpoint command wiring.

Prefer CLI First

Use inngest-api-cli for:

• Run and trace debugging from a run ID or event ID.
• Account, environment, key, webhook, app sync, and function invocation checks.
• Insights table/schema/query workflows.
• Local dev server or Cloud operational checks.

Use raw REST API v2 only when:

• The CLI does not expose the needed endpoint.
• The user explicitly asks for HTTP, curl, fetch, OpenAPI, or API docs.
• You need to inspect request/response schemas before deciding what to do.

Docs Lookup

When precision matters, fetch current docs instead of guessing:

• API overview: https://api-docs.inngest.com/
• Authentication: https://api-docs.inngest.com/authentication
• LLM index: https://api-docs.inngest.com/llms.txt
• OpenAPI v2 spec: https://api-docs.inngest.com/api-specs/v2.json
• Markdown page pattern: add .md to a docs URL, for example https://api-docs.inngest.com/v2/runs/GetFunctionTrace.md
• Endpoint request/response schemas: references/rest-api-v2.md

If a Markdown page returns an error or omits generated reference details, use the OpenAPI spec for methods, paths, parameters, request bodies, and schemas.

Base URLs

• Cloud v2: https://api.inngest.com/v2
• Local dev server v2: http://localhost:8288/api/v2
• API docs say the dev server may also be reached through the local server origin. Confirm the actual dev server port before making local requests.

Authentication

The REST API uses Bearer token authentication.

• Prefer INNGEST_API_KEY for requests from CI, scripts, tools, and agents.
• Signing keys are primarily for apps communicating with Inngest; use them for API requests only when that is the available, appropriate credential.
• API keys are for v2 endpoints only.
• Include X-Inngest-Env or use an environment-scoped API key when operating outside the default production environment.
• Never paste, print, commit, or log API keys, event keys, signing keys, webhook URLs, or decrypted secrets.

Example:

curl -fsSL \
  -H "Authorization: Bearer $INNGEST_API_KEY" \
  -H "X-Inngest-Env: $INNGEST_ENV" \
  https://api.inngest.com/v2/account

Endpoint Discovery

Use the OpenAPI spec as the source of truth:

curl -fsSL https://api-docs.inngest.com/api-specs/v2.json

Current v2 areas include account, environments, keys, webhooks, apps, function invocation, event-run lookup, function runs, traces, Insights, and partner APIs. Endpoint coverage can change, so inspect the spec before writing a raw request.

For API-only or access-gated endpoints, such as partner-account endpoints, confirm the user has the needed access before attempting a call.

Request Rules

• Derive method, path, query params, headers, and body from OpenAPI.
• Do not invent undocumented request fields.
• Use structured JSON parsing before making decisions from responses.
• Use body files or here-docs for complex JSON instead of shell-escaped one liners.
• Add pagination cursors when page.hasMore is true and complete results are needed.
• Treat missing data in list responses as an empty list unless an error is present.

Mutation Safety

Read before write. Confirm target account, environment, resource, and intent before raw HTTP mutations unless the user's instruction already makes all of that explicit.

Treat these categories as mutating or side-effecting:

• Creating or patching environments.
• Creating webhooks.
• Syncing apps.
• Invoking functions.
• Partner account creation.
• Broad Insights queries that may be expensive or noisy.

Output Handling

• Summarize IDs, names, statuses, pagination, and actionable errors.
• Redact token values, webhook URLs, sensitive payload fields, and decrypted secrets.
• Do not paste large raw traces, full OpenAPI fragments, or full response bodies unless the user asks.
• If auth fails, first verify that a credential is present in the environment; then ask the user to provide or rotate INNGEST_API_KEY without pasting it into chat.