# App routes

URL: /code/api/app · Id: `page:code/api/app`

> Every App Verb as an api.sb route, with its inputs, result, refusals and an example.

Reference for [App](/business/nouns/app).

### App.publish
Publish releases an App to its Customers, so each Tenant runs its newest build. [Verb page](/business/nouns/app/publish?interface=api).

```text
POST /{namespace}/apps/{app}/publish
```

Path: `app`. Emits [`App.published`](/business/events/App.published).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `app` | [App](/business/nouns/app) | Yes | The App to release. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `app` | [App](/business/nouns/app) | Yes | The App, now released. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |
| The record is not in a state that allows this Verb, so the call is refused. | [`refused`](/code/api/errors/refused) | Read the record, run the Verb that moves it to an allowed state, then retry. | None. |

**Example**

```bash
curl -X POST https://api.sb/leaseline.app/apps/app_sAebuEW683/publish \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

```json
{
  "api": "https://api.sb/leaseline.app",
  "app": {
    "$id": "https://api.sb/leaseline.app/apps/app_sAebuEW683",
    "$type": "App",
    "kind": "api"
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/act_br07HsG8MG",
    "operation": "App.publish",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/act_br07HsG8MG"
  }
}
```