Get the authenticated Origin App via the API

Return metadata for the app that signed the request with GET https://api.cursor.com/v1/origin/app. Official reference: Origin API → Get Authenticated App.

Origin is in Early Beta and subject to change. Authenticate with an app JWT (EdDSA, signed with the app's Ed25519 private key; iss and kid set to the app ID; lifetime about five minutes). Installation tokens and Cursor API keys do not authenticate this endpoint. Availability: Early Beta per the API overview.

No installation scope is required — presenting a valid app JWT is enough.

Request

curl --request GET \
  --url 'https://api.cursor.com/v1/origin/app' \
  --header 'Authorization: Bearer YOUR_APP_JWT'

Response fields

Field	Meaning
id	Origin app identifier used as the JWT issuer and key ID.
displayName	Human-readable app display name.
webhookUrl	Registered HTTPS URL that receives webhook deliveries.
events	Webhook event subscriptions configured for the app.
createdAt	RFC 3339 timestamp for app creation.
updatedAt	RFC 3339 timestamp for the latest app metadata update.
installationRedirectUris	Registered installation callback URIs; non-local callbacks must match exactly and use HTTPS.
namespaceSlug	Slug of the namespace that owns the app.
description	Publisher-provided app description. Empty when unset.
websiteUrl	Publisher website. Empty when unset.
defaultScopes	Default scopes offered when the app is installed, as catalog scope strings.

Example:

{
  "id": "app_01k2ja2000e0080000000000a1",
  "displayName": "CI Status Bot",
  "webhookUrl": "https://ci.acme.dev/webhooks/origin",
  "events": [
    "pull_request.created",
    "pull_request.merged"
  ],
  "createdAt": "2026-08-01T09:30:00Z",
  "updatedAt": "2026-08-02T14:45:00Z",
  "installationRedirectUris": [
    "https://ci.acme.dev/origin/setup"
  ],
  "namespaceSlug": "acme",
  "description": "Posts CI status on pull requests.",
  "websiteUrl": "https://ci.acme.dev",
  "defaultScopes": [
    "repository:contents:read",
    "repository:pull_requests:read"
  ]
}

Use this self-read to confirm the app ID, webhook URL, redirect allowlist, and default scopes before listing installations or minting installation access tokens. Publishers reading another app by ID use GET /v1/origin/apps/{appId} with a user access token and namespace:apps:read instead.

Base URL: https://api.cursor.com/v1/origin.