POST/products

Creates a product in the caller's workspace. Only name is required: when slug is omitted the slug is derived from the name, and when it is supplied it is still slugified before validation, so My Product and my-product both land on my-product. The plan allowance is checked before the slug uniqueness check, so a workspace at its cap gets 402/409 even when the slug would also have collided. New products are always public (isPrivate: false) - use PATCH to make one private. Icons cannot be set here or in PATCH. The response is built from the freshly inserted row, so isPrivate is always false, updatedAt is always null, and there is no locked field; call GET /products/{slug} if you need the settled shape.

Requires the products:write scope.

curl --request POST \
  --url 'https://api.envless.cloud/products' \
  --header 'Authorization: Bearer ev_sk_xxxxxxxxxxxx' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "Billing",
  "slug": "billing"
}'

Try itPOSThttps://api.envless.cloud/products

Authorization

Authorizationstringrequiredheader
Bearer token: an Envless API key (ev_sk_…), created in the dashboard or with POST /keys. The key is bound to one workspace; every request runs inside it.

Request body

application/json · required

namestringrequiredmin length 3max length 50
Display name. Required.
slugstringmin length 3max length 50pattern ^[a-z0-9]+(?:-[a-z0-9]+)*$
Optional URL slug, unique per workspace. Slugified server-side before validation; derived from name when omitted or blank.

Responses

201Created

Create a product succeeded.

successbooleanrequired
codeintegerrequired
The HTTP status of this response, repeated in the body.
messagestringrequired
errornullrequired
dataobjectrequired
Show child attributesHide child attributes
- idstringrequired
- namestringrequired
- slugstringrequired
- iconstring | null
- isPrivatebooleanrequired
- lockedboolean
  True when the product exceeds the plan limit and is read-only until you upgrade.
- createdAtstringrequireddate-time
- updatedAtstring | nulldate-time
_reqobject
Show child attributesHide child attributes
- reqIdstring
- resTimeinteger | null

{
    "success": true,
    "code": 201,
    "message": "OK",
    "error": null,
    "data": {
        "id": "<string>",
        "name": "<string>",
        "slug": "<string>",
        "icon": "<string>",
        "isPrivate": true,
        "locked": true,
        "createdAt": "2026-05-30T10:14:22.000Z",
        "updatedAt": "2026-05-30T10:14:22.000Z"
    },
    "_req": {
        "reqId": "<string>",
        "resTime": 1
    }
}

Error envelope

Every failure below returns the same shape with success: false; branch on error.code, never on message.

successbooleanrequired
codeintegerrequired
The HTTP status of this response, repeated in the body.
messagestringrequired
errorobjectrequired
Machine-readable failure detail. Null on success.
Show child attributesHide child attributes
- codeenum<string>required
  Stable error code. Branch on this, never on message.
  Options: "auth.api_key_required", "auth.api_key_not_found", "auth.api_key_user_missing", "auth.api_key_owner_not_member", "auth.scope_missing", "auth.scope_ceiling_exceeded", "auth.key_project_restricted", "auth.product_restricted", "auth.permission_denied", "auth.self_mutation_forbidden", "auth.step_up_required", "auth.step_up_fresh_required", "auth.cli_token_not_accepted", "auth.two_factor_required", "auth.workspace_two_factor_required", "auth.two_factor_invalid", "auth.two_factor_replayed", "auth.two_factor_locked", "auth.two_factor_not_enabled", "auth.two_factor_already_enabled", "request.body_must_be_json", "request.body_invalid", "request.body_too_large", "request.rate_limited", "request.invalid_pagination", "workspace.not_found", "workspace.slug_conflict", "workspace.limit_reached", "workspace.delete_last", "workspace.delete_too_early", "workspace.delete_has_projects", "domain.not_configured", "domain.not_found", "domain.invalid", "domain.taken", "domain.attempt_limit", "product.not_found", "product.slug_conflict", "product.locked", "project.not_found", "project.ambiguous_product", "project.slug_conflict", "environment.not_found", "environment.slug_conflict", "environment.expose_disabled", "environment.expose_private_product", "variable.not_found", "variable.name_conflict", "variable.ciphertext_invalid", "variable.baseline_drifted", "version.not_found", "member.not_found", "member.already_exists", "member.self_invite", "member.self_mutation", "member.owner_immutable", "member.owner_cannot_leave", "member.seat_limit", "invite.already_pending", "role.owner_not_assignable", "role.limit_reached", "role.immutable", "role.in_use", "invite.not_found", "invite.expired", "role.not_found", "role.name_conflict", "key.not_found", "key.limit_reached", "webhook.not_found", "webhook.delivery_not_found", "plan.limit_reached", "plan.upgrade_required", "request.not_found", "request.method_not_allowed", "request.conflict", "auth.unauthorized", "auth.forbidden", "request.invalid", "server.error"
- resourcestring
  The resource or scope the failure relates to.
- fieldstring
  The request field that caused the failure.
dataobject | nullrequired
Null on most failures. A plan limit carries { limit, current }.
_reqobject
Show child attributesHide child attributes
- reqIdstring
- resTimeinteger | null

{
    "success": false,
    "code": 400,
    "message": "Something went wrong.",
    "error": {
        "code": "auth.api_key_required",
        "resource": "<string>",
        "field": "<string>"
    },
    "data": {},
    "_req": {
        "reqId": "<string>",
        "resTime": 1
    }
}

400Bad Request

request.body_must_be_json - the body is absent or not parseable as JSON.
request.body_invalid - name is not a string (field name), or name/slug fails length or slug-pattern validation.

401Unauthorized

auth.api_key_required - the Authorization header is missing, or its value does not start with ev_sk_.
auth.api_key_not_found - the key is unknown, inactive or revoked.
auth.api_key_user_missing - the key is valid but its owner no longer exists.
auth.api_key_owner_not_member - the key's owner is no longer a member of the key's workspace.

402Payment Required

plan.upgrade_required - the workspace already holds its plan's product allowance (Free 1, Dev 3, Team 15; Enterprise is unlimited and never hits this). data carries { limit, current }.

403Forbidden

auth.key_project_restricted - the key is scoped to a list of project ids; such keys can never create or mutate products.
auth.scope_missing - the key lacks products:write.
auth.workspace_two_factor_required - the workspace requires two-factor authentication and the key's owner has not turned it on.

409Conflict

plan.limit_reached - reserved for a plan whose product allowance sits at or above the 1,000 fair-use cap. No current tier can trigger it: Free, Dev and Team fail with 402 plan.upgrade_required at their own allowance instead, and Enterprise is unlimited and never hits a plan limit. data carries { limit, current }.
product.slug_conflict - another product in the workspace already owns the resolved slug.

413Payload Too Large

request.body_too_large - the request body is larger than 1 MiB (1,048,576 bytes).

500Internal Server Error

server.error - an unexpected error; retry with backoff.

503Service Unavailable

server.error - the API is in maintenance mode or is missing its configuration; retry with backoff.

Authorization#

Request body#

Responses#

201Created#

Error envelope#

400Bad Request#

401Unauthorized#

402Payment Required#

403Forbidden#

409Conflict#

413Payload Too Large#

500Internal Server Error#

503Service Unavailable#