canonical: https://jentic.com/apis/appwrite.io/server

# Appwrite

Jentic publishes the only available OpenAPI specification for Appwrite, keeping it validated and agent-ready. This is the server-side surface of the Appwrite open-source backend-as-a-service - 95 operations across 65 paths exercised with an admin API key. It includes admin operations on /users, project-level configuration under /projects, server-side function management at /functions, and full read/write access to /database and /storage that bypasses per-user permission rules. Use this from trusted server code, never from the browser or a mobile client.

## For AI agents

Server-side Appwrite surface authenticated by an admin API key: full /users administration, /projects configuration, /functions, /database, /storage. 95 endpoints.

## Scope

Does not run on the client side or accept user session JWTs - use the Appwrite Client API for user-context calls; this server API requires an admin key only.

## Capabilities

- Create, list, update, and delete user accounts admin-side via /users
- Configure projects, OAuth providers, and webhooks via /projects
- Read and write any document in any collection regardless of per-user rules
- Upload, read, and delete files in any storage bucket regardless of bucket permissions
- Manage cloud functions including code deployment, tags, and execution at scale
- Read /health endpoints to monitor self-hosted Appwrite deployment status
- Administer team rosters and role assignments without acting as a member

## Use cases

### Backend-Side User Administration

An internal admin tool uses the Appwrite Server API to create test users, reset passwords for support cases, suspend abusive accounts, and bulk-import users from a CSV. Server-key calls bypass user session requirements, so the tool can act on any account. The /users endpoint group covers create, list, update, delete, and session revocation operations.

Example prompt: POST /users with an email, password, and name to create a new user, then DELETE /users/{userId}/sessions to invalidate any existing sessions

### CI Function Deployment

A CI pipeline deploys new versions of Appwrite cloud functions on every merge to main. The Server API exposes /functions for create and update, /functions/{functionId}/tags for code uploads, and /functions/{functionId}/executions for smoke tests. The full deploy-and-verify cycle runs from a CI job using only the project's admin key.

Example prompt: POST /functions/{functionId}/tags with the new function code, then POST /functions/{functionId}/executions to verify it runs

### Project Configuration as Code

Teams keep their Appwrite project configuration - OAuth providers, webhooks, platform allowlists, JWT settings - under version control and apply changes through the /projects API. This makes project setup reproducible across staging and production without clicking through the Appwrite console for each environment.

Example prompt: POST /projects/{projectId}/webhooks with name, URL, and events list including database.documents.create

### AI Agent Server-Side Automation

An AI agent with delegated server-key access uses Jentic to perform administrative work - provisioning users for a new tenant, deploying function code, writing audit logs into a privileged collection. Because the server API key has full access, Jentic's vault isolation is critical: the key stays in your Jentic One instance and the agent only sees scoped credentials at execution time.

Example prompt: Search Jentic for 'create appwrite user as admin', call POST /users, then POST /teams/{teamId}/memberships to add the user to the tenant team

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /users | Create a new user account admin-side |
| GET | /users | List all users in the project |
| POST | /projects/{projectId}/webhooks | Configure a webhook on a project |
| POST | /functions/{functionId}/tags | Upload a new code tag for a function |
| POST | /functions/{functionId}/executions | Execute a function with a payload |
| POST | /storage/files | Upload a file to any storage bucket |
| GET | /health | Read the overall health status of the Appwrite instance |

## Key resources

- **users** — Server-side user administration: create, list, update, delete, sessions
- **projects** — Project-level configuration including OAuth, webhooks, platforms
- **database** — Read and write any document with full bypass of permission rules
- **storage** — Manage all storage buckets and files regardless of bucket permissions
- **functions** — Create, deploy, tag, and execute cloud functions
- **teams** — Administer teams and memberships without acting as a member
- **health** — Self-hosted readiness and status checks

## Why Jentic

- **Setup:** Wiring the Appwrite server surface by hand means managing the X-Appwrite-Project header plus the scoped admin API key, and mapping its user, project, function, and storage operations yourself. Through Jentic you install once, import the Appwrite Server API from the API Directory, store the admin key once, and your agent calls it.
- **Permission scoping:** The server surface puts project and function ids in the URL path (/projects/{projectId}/webhooks, /functions/{functionId}/executions), so a rule can pin your agent to one project or function. You choose the operations it may call, so user creation or webhook writes are not included unless you add them, which keeps the admin key's reach narrow.
- **Credential handling:** Your Appwrite admin key is stored once, encrypted, by your own Jentic One instance and attached at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create an Appwrite user' or 'deploy an Appwrite function', and Jentic returns the matching server-surface operation with its parameters and response schema so the agent calls the right endpoint without scrolling the docs.

## Related APIs

- **Appwrite Client API** — User-session surface that pairs with this admin server surface
- **Supabase API** — Postgres-backed BaaS with a similar service-role-key admin surface
- **Firebase API** — Google's BaaS with the Firebase Admin SDK as the admin equivalent

## FAQ

### Why is there no official OpenAPI spec for Appwrite?

Appwrite does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Appwrite via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Appwrite Server API use?

It uses two headers: X-Appwrite-Project (the project id) and X-Appwrite-Key (a server API key generated from the Appwrite console with explicit scopes). The key bypasses per-user rules, so it must never be exposed to client-side code. Through Jentic the key stays vaulted and is attached at execution time only.

### Can I create users without a sign-up flow?

Yes. POST /users creates a user record directly with email, password, and optional name; the user can log in afterward via the client surface. This is the standard pattern for migrating users from another auth system or pre-creating accounts for invited tenants.

### What are the rate limits for the Appwrite Server API?

Self-hosted Appwrite is bounded by your server's capacity. Appwrite Cloud applies plan-based quotas covering bandwidth, storage, function executions, and database operations. Server-key calls share the project quota with client-key calls; there is no separate admin allowance.

### How do I deploy a new function tag through Jentic?

Run pip install jentic, search 'deploy appwrite function', and load POST /functions/{functionId}/tags. Execute it with the function id, command, and code archive. Jentic injects the X-Appwrite-Key from the vault and returns the new tag id.

### Is the Appwrite Server API free?

Self-hosted Appwrite is fully open source under BSD-3-Clause and free. Appwrite Cloud has a free tier for hobby projects plus Pro and Scale paid plans for production usage; the server API is included on every plan.

### Can I limit what my agent is allowed to do with the Appwrite Server API?

Yes. Because you run Jentic One yourself, your own rules decide which Appwrite operations the agent may call, so you can allow reads while withholding admin actions like user creation (POST /users) or webhook writes (POST /projects/{projectId}/webhooks) unless you explicitly add them. Since project and function ids live in the URL path, such as /projects/{projectId}/webhooks and /functions/{functionId}/executions, a rule can pin the agent to a single project or function. This keeps the admin key's reach narrow even though the key itself carries full access.