MiniUp Account API

The MiniUp Account API lets your own scripts, servers, CLIs, and authorized applications work with resources in a MiniUp account.

Base URL

https://www.miniup.io/api/v1

OpenAPI 3.1 document

https://www.miniup.io/api/v1/openapi.json

The API uses normal HTTPS, JSON, and Bearer authentication. It is a conventional REST-style API; it is not an OpenAI-specific protocol. OAuth clients use standard OAuth 2.0 Authorization Code with PKCE.

The OpenAPI document describes the current Account API paths, request shapes, OAuth scopes, personal API key authentication, and common responses. Tools that understand OpenAPI can import the schema directly instead of maintaining a separate endpoint definition.

Quick start with a personal API key

Create a key from MiniUp → Account API at /dashboard/api. Select only the scopes the automation needs. The full secret is shown once.

Send the key in the standard Authorization header:

curl https://www.miniup.io/api/v1/sites \
  -H "Authorization: Bearer miniup_pat_YOUR_KEY"

Check account usage:

curl https://www.miniup.io/api/v1/usage \
  -H "Authorization: Bearer miniup_pat_YOUR_KEY"

Personal API keys use the account’s normal MiniUp quotas. Creating an API key does not create another account or a separate usage pool.

Authentication

MiniUp Account API supports two credential types.

Personal API keys are stored by MiniUp only as a cryptographic hash. Rotate or revoke them from the authenticated MiniUp dashboard. Account API credentials cannot use /api/v1 to create, rotate, or revoke other account credentials.

Scopes

A credential can only use operations allowed by its scopes.

A missing scope returns an authorization error rather than silently widening access.

Endpoints

Management operations are checked against the authenticated MiniUp account’s ownership. Knowing another user’s Site or Function ID does not grant management access. Function invocation is different: /functions/invoke/:slug may call a Function owned by another MiniUp account only when that Function is live and explicitly enables MiniUp Users.

Use the OpenAPI document

Fetch the schema directly:

curl https://www.miniup.io/api/v1/openapi.json

The document is OpenAPI 3.1 and includes both supported Account API authentication schemes:

• scoped MiniUp personal API keys using HTTP Bearer authentication;
• OAuth 2.0 Authorization Code with PKCE and MiniUp scopes.

Function invocation through /api/v1/functions/invoke/:slug currently uses personal API keys with the miniup.functions.invoke scope. The Account API OAuth scope catalog is intentionally unchanged.

For OAuth clients, the OpenAPI document also identifies the Account API resource as https://www.miniup.io/api/v1. OpenAPI itself does not replace OAuth consent or MiniUp scope enforcement; it describes how a client should call the API.

Publish a Site

POST /api/v1/sites requires requestId and html.

curl https://www.miniup.io/api/v1/sites \
  -X POST \
  -H "Authorization: Bearer miniup_pat_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "requestId": "deploy-home-001",
    "slug": "my-site",
    "html": "<h1>Hello from MiniUp</h1>"
  }'

Use a unique requestId for the publish request. The request is processed through the same MiniUp publishing services and account limits used elsewhere in MiniUp.

Read Site content

Read all supported text content:

curl "https://www.miniup.io/api/v1/sites/SITE_ID/content" \
  -H "Authorization: Bearer miniup_pat_YOUR_KEY"

Request specific paths by repeating the path query parameter:

/api/v1/sites/SITE_ID/content?path=index.html&path=app.js

Work with Functions

Create a Function:

curl https://www.miniup.io/api/v1/functions \
  -X POST \
  -H "Authorization: Bearer miniup_pat_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Hello API",
    "slug": "hello-api",
    "code": "export default { async fetch() { return Response.json({ ok: true }); } }"
  }'

Update its draft:

curl https://www.miniup.io/api/v1/functions/FUNCTION_ID/draft \
  -X PUT \
  -H "Authorization: Bearer miniup_pat_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"code":"export default { async fetch() { return Response.json({ version: 2 }); } }"}'

Publish it:

curl https://www.miniup.io/api/v1/functions/FUNCTION_ID/publish \
  -X POST \
  -H "Authorization: Bearer miniup_pat_YOUR_KEY"

For security, Account API draft/publish operations are not allowed for a Function that already contains configured MiniUp Function Secrets. Manage and publish secret-backed Functions from MiniUp’s secure Function management surface instead. Secret values are never returned by the Account API.

Invoke a Function shared with MiniUp Users

A personal API key with miniup.functions.invoke can invoke a live Function that explicitly enables MiniUp Users, even when another MiniUp account owns that Function.

curl https://www.miniup.io/api/v1/functions/invoke/pocket \
  -X POST \
  -H "Authorization: Bearer miniup_pat_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "method": "PUT",
    "path": "/state/favorite-city",
    "body": "Houston"
  }'

The wrapper accepts GET, POST, PUT, PATCH, and DELETE, a relative path, an optional query string, a small safe set of forwarded headers, and a JSON-serializable or text body. Request bodies are bounded to 128 KiB and the Account API returns at most 256 KiB of Function response content, marking larger responses as truncated.

MiniUp derives the Function caller from the Account API key’s owning account. The caller cannot provide or override another user’s identity. The Function receives the normal Function-scoped MINIUP_CALLER identity for that MiniUp account, so MINIUP_MEMORY.caller remains isolated by account and Function. No Function API key is exposed to the caller.

This endpoint does not grant Function management rights. It rejects unpublished, cleanup-pending, or non-MiniUp-User Functions even when the caller knows the Function slug.

OAuth 2.0 + PKCE

Use OAuth when another application needs to act on behalf of a MiniUp user. The Account API resource identifier is:

https://www.miniup.io/api/v1

MiniUp uses Authorization Code with PKCE (S256). A typical public-client flow is:

1. Register the OAuth client with its exact redirect URI.
2. Redirect the user to the authorization endpoint with the requested MiniUp scopes, Account API resource, and PKCE challenge.
3. The user signs in to MiniUp and approves the requested scopes.
4. Exchange the returned authorization code and PKCE verifier for an access token.
5. Send the access token as a Bearer credential to /api/v1.
6. Use the rotating refresh token when a new access token is required.

Production endpoints:

Client registration: https://www.miniup.io/api/oauth/register
Authorization:       https://www.miniup.io/oauth/authorize
Token:               https://www.miniup.io/oauth/token
Resource:            https://www.miniup.io/api/v1
OpenAPI:             https://www.miniup.io/api/v1/openapi.json

Example authorization parameters:

response_type=code
client_id=YOUR_CLIENT_ID
redirect_uri=https://app.example.com/callback
scope=miniup.sites.read miniup.usage.read
resource=https://www.miniup.io/api/v1
code_challenge=...
code_challenge_method=S256
state=...

Redirect URIs are exact-match. Production redirect URIs must use HTTPS; localhost development may use HTTP.

JSON requests and errors

For endpoints with request bodies, send:

Content-Type: application/json

Account API JSON bodies are limited to 1 MiB. Function invocation applies the tighter request and response limits described above. Common responses include:

• 400 for invalid input.
• 401 for missing, invalid, expired, or revoked credentials.
• 403 when the credential lacks the required scope or the operation is forbidden.
• 404 when an owned resource cannot be found or a Function is not callable through MiniUp Users.
• 429 when an applicable MiniUp limit or rate limit is reached.
• 5xx for an internal service failure. MiniUp sanitizes server-side provider errors before returning them through the Account API.

Browser calls

The API uses Bearer credentials rather than MiniUp login cookies. Browser requests are also subject to MiniUp’s platform origin policy. For personal automation, a server, CLI, or CI environment is usually the simplest place to use a personal API key.

Never place a personal API key in public frontend JavaScript or a published Site.

Related guides

• MiniUp Public API and Runtime Contracts
• Function access
• Tables and data
• Limits and usage