---
title: "Endpoint"
description: "The `Endpoint` entity."
section: "Reference"
group: "Types"
order: 82
---

## Definition

```ts
interface Endpoint {
  id: string;
  apiId: string;
  method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
  path: string;
  handlerType: "function" | "workflow" | "agent" | "swarm";
  handlerId: string;
  auth:
    | { kind: "public"; rateLimitPerMinute?: number | undefined }
    | { kind: "workspace_api_key" }
    | { kind: "oauth"; scope: string }
    | { kind: "event_signature"; secretSource: "secret_ref"; secretId: string }
    | null;
  cors: {
    allowOrigins: Array<string>;
    allowCredentials?: boolean | undefined;
  } | null;
  timeoutSeconds: number;
  enabled: boolean;
  createdAt: string;
  updatedAt: string;
}
```

## Fields

| Field            | Type                                                                                                                                                                                                                         | Notes                                                                                              |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| `id`             | `string`                                                                                                                                                                                                                     | `readonly` `required`                                                                              |
| `apiId`          | `string`                                                                                                                                                                                                                     | `required` — Parent api.                                                                           |
| `method`         | `"GET" \| "POST" \| "PUT" \| "PATCH" \| "DELETE"`                                                                                                                                                                            | `required` — HTTP method this endpoint accepts (GET, POST, PUT, PATCH, DELETE).                    |
| `path`           | `string`                                                                                                                                                                                                                     | `required` — Literal path relative to the api root, e.g. /checkout.                                |
| `handlerType`    | `"function" \| "workflow" \| "agent" \| "swarm"`                                                                                                                                                                             | `required` — Kind of primitive bound as the handler (`function`, `workflow`, `agent`, or `swarm`). |
| `handlerId`      | `string`                                                                                                                                                                                                                     | `required` — Prefixed ID of the bound primitive.                                                   |
| `auth`           | `{ kind: "public"; rateLimitPerMinute?: number \| undefined; } \| { kind: "workspace_api_key"; } \| { kind: "oauth"; scope: string; } \| { kind: "event_signature"; secretSource: "secret_ref"; secretId: string; } \| null` | `required` — Per-endpoint auth override; null inherits from api.auth.                              |
| `cors`           | `{ allowOrigins: Array<string>; allowCredentials?: boolean \| undefined; } \| null`                                                                                                                                          | `required` — Per-endpoint CORS override; null inherits from api.cors.                              |
| `timeoutSeconds` | `number`                                                                                                                                                                                                                     | `required` — Per-endpoint timeout in seconds (1–300). Hard cap on handler execution time.          |
| `enabled`        | `boolean`                                                                                                                                                                                                                    | `required` — Whether the endpoint accepts traffic; false returns 503.                              |
| `createdAt`      | `string`                                                                                                                                                                                                                     | `readonly` `required` — ISO-8601 timestamp of creation.                                            |
| `updatedAt`      | `string`                                                                                                                                                                                                                     | `readonly` `required` — ISO-8601 timestamp of the last update.                                     |