Sample - GitHub REST API
POST/app-manifests/{code}/conversions

Create a GitHub App from a manifest

Creates a GitHub App from a temporary manifest-flow code. Use code to complete the manifest handshake and retrieve the app's identifiers, credentials, private key, and webhook secret. A 201 response returns the created GitHub App and its generated credentials.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

1 parameter
codestringrequired
The temporary code received when creating a GitHub App through the manifest flow.

3 status codes
201Returns the created GitHub App, including its identifiers, owner, metadata, permissions, events, client credentials, webhook secret, and private key.
idintegerrequired
Unique identifier of the GitHub app
slugstringoptional
The slug name of the GitHub app
node_idstringrequired
client_idstringrequired
ownerobjectrequired
A GitHub user.
namestringrequired
The name of the GitHub app
descriptionstringrequired
external_urlstringrequired
html_urlstringrequired
created_atstringrequired
updated_atstringrequired
permissionsobjectrequired
The set of permissions for the GitHub app
eventsarray<string>required
The list of events for the GitHub app. Note that the `installation_target`, `security_advisory`, and `meta` events are not included because they are global events and not specific to an installation.
installations_countintegeroptional
The number of installations associated with the GitHub app. Only returned when the integration is requesting details about itself.
client_secretstringrequired
webhook_secretstringrequired
pemstringrequired
404Returned when the temporary manifest-flow `code` does not identify a resource.
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
422Returned when validation fails or the endpoint has been spammed.
messagestringrequired
documentation_urlstringrequired
errorsarray<string>optional

Error handling

A 404 is returned when the temporary code does not identify a valid manifest-flow resource. A 422 is returned when validation fails or the endpoint has been spammed; provide a valid code and retry only when appropriate.