--- type: "post" id: "origin-api-apps-can-create-repositories-and-download-d2dce0" slug: "origin-api-apps-can-create-repositories-and-download-d2dce0" title: "Origin API: apps can create repositories and download repo tarballs" description: "Cursor has documented app-level repository creation and repository-archive downloads in the Origin API." retrieval_nugget: "Cursor has documented app-level repository creation and repository-archive downloads in the Origin API. The change matters to teams building code-hosting integrations because access is shaped by a specific scope, installation selection mode, administrator approval, redirect handling, and namespace network policy." published_at: "2026-11-08" updated_at: "2026-11-08" record_date: "2026-11-08" date_kind: "published_at" topics: ["api-design","developer-tools"] entities: ["Cursor","Origin API"] related_patterns: ["agent-ready-software-exposes-capabilities"] novelty_label: "new_fact" what_changed: null prior_refs: [] source_url: "https://cursor.com/docs/api/origin/changelog" source_urls: ["https://cursor.com/docs/api/origin/changelog"] schema_version: "newruntime-agent-readable-v0.2" stable_id: "post:origin-api-apps-can-create-repositories-and-download-d2dce0" status: "published" visuals: [] editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]} routes: {"html":"https://newruntime.com/posts/origin-api-apps-can-create-repositories-and-download-d2dce0/","markdown":"https://newruntime.com/posts/origin-api-apps-can-create-repositories-and-download-d2dce0.md","json":"https://newruntime.com/posts/origin-api-apps-can-create-repositories-and-download-d2dce0.json"} markdown_url: "https://newruntime.com/posts/origin-api-apps-can-create-repositories-and-download-d2dce0.md" --- # Origin API: apps can create repositories and download repo tarballs ## Retrieval answer Cursor has documented app-level repository creation and repository-archive downloads in the Origin API. The change matters to teams building code-hosting integrations because access is shaped by a specific scope, installation selection mode, administrator approval, redirect handling, and namespace network policy. ## Summary Cursor has documented app-level repository creation and repository-archive downloads in the Origin API. The change matters to teams building code-hosting integrations because access is shaped by a specific scope, installation selection mode, administrator approval, redirect handling, and namespace network policy. ## What happened Cursor’s Origin API changelog says applications can create repositories when they have the `namespace:repositories:create` scope. The relevant operation is Create Repo. Cursor ties availability of that operation to the installation model: an app installation with all-repository selection for a namespace can use it, while an installation limited to selected repositories cannot. That distinction makes repository creation different from simply reading or working with a repository that has already been selected for an app. A team cannot assume that granting an integration access to a chosen set of repositories also permits it to provision a new one. The changelog further says that an already-installed app receives the new scope only after a workspace administrator re-approves the installation. In practice, the capability is therefore conditional on both the app’s requested permission and an administrative decision about the installation. The changelog also describes Get Repo Tarball as an app-callable endpoint for retrieving a repository archive with `contents:read`. A September 17, 2026 entry specifies the archive layout: the returned archive is wrapped in a top-level directory using the GitHub-style `{ownerSlug}-{repoName}-{shortSha}/` format. That is a concrete implementation detail for a client that unpacks an archive and needs to locate files consistently rather than infer a directory name after download. Entries dated October 22 and October 23, 2026 describe the download path for requests authenticated with an installation token. Rather than delivering the archive as the final response at the endpoint, Cursor returns a 302 redirect to a short-lived signed URL. The namespace inbound IP allowlist is enforced for those calls. A client using this endpoint must therefore follow redirects, and a team operating with network restrictions must make its request path compatible with the namespace’s allowlist. Taken together, these are not a single broad permission change. They describe several connected surfaces of an Origin integration: creating a repository, obtaining read access to repository contents, downloading an archive, and operating within application-installation and network controls. The practical boundary is especially clear for creation: selected-repository installations are excluded, and existing installations require a workspace administrator’s re-approval before the scope can be used. ## What the archive adds New Runtime’s earlier coverage on October 16 described Origin’s marketplace as a reviewed distribution surface for third-party developer apps, not merely a list of integrations ([Origin’s marketplace and integrations](https://newruntime.com/posts/origin-cursor-s-code-hosting-platform-now-supports-d22f66/)). This is a new fact on that known story: Origin now documents application-level repository creation and archive retrieval, with explicit conditions around permissions and network access. An earlier New Runtime note on September 18 described Origin as code hosting with repositories, pull requests, code browsing, and two-way GitHub sync ([Cursor launches Origin code hosting](https://newruntime.com/posts/cursor-launches-origin-code-hosting-as-a-github-alternative/)). The API details extend that platform story from repository hosting into operations that external applications can invoke. ## Trend signal This supports [agent-ready software exposes capabilities](https://newruntime.com/patterns/agent-ready-software-exposes-capabilities/). Origin is defining discrete operations that an external application can compose: create a repository, read contents, and fetch an archive. Those operations are bounded by named scopes, installation selection modes, administrator approval, redirects, and IP policy. This is evidence of an explicit capability surface, not proof that autonomous agents are broadly using it or that Origin has become a general interoperability layer. ## Why now The changelog dates the repository-creation scope and the installation-token archive-download behavior to October 22–23, 2026. For a team already developing an Origin integration, the timing makes these current implementation constraints: an existing installation may need re-approval before it can create repositories, and download clients need to account for the redirect path now. ## Why it matters Repository creation changes what an integration can initiate. A workflow can potentially provision a repository as part of a setup, migration, or automation sequence rather than stopping for a person to create the repository manually. But this is deliberately not the same as access to a small set of chosen repositories. The all-repository selection requirement creates a wider permission context, so teams need to decide whether the workflow justifies that installation posture. The re-approval requirement is equally important. Existing apps do not silently gain the new permission: a workspace administrator is part of the rollout path. That introduces a review point where a team can inspect why an app wants repository creation and whether its installation configuration remains appropriate. Archive retrieval has operational consequences too. A downloader that expects a tarball in the initial response needs to handle a 302 redirect and then request a short-lived signed URL. Network controls cannot be treated as a separate operational concern, because the namespace inbound IP allowlist applies to the documented flow. Permissions, HTTP-client behavior, and infrastructure policy all belong in the integration test plan. ## What happens next - **Origin integrations will add repository-provisioning workflows where the broader installation permission is acceptable** (3 months, 65%). Watch for: apps requesting `namespace:repositories:create` during installation. - **Teams will formalize tests for redirect and allowlist behavior in archive-download clients** (3 months, 70%). Watch for: implementation guidance or client-library updates around Get Repo Tarball. ## Limits and uncertainty The change is documented by Cursor, but its production behavior has not been independently tested here. The available details do not measure adoption, request volume, reliability, latency, or the real-world duration of signed download URLs. They also do not show how frequently workspace administrators approve the broader all-repository installation configuration, or how teams will use repository creation in practice. The scope and installation rules are implementation-sensitive. A team should verify the behavior in its own namespace, with its own app installation and inbound IP policy, before designing a production workflow around it. The changelog establishes documented API behavior; it does not establish the security posture or operational suitability of every integration built on that behavior. ## Skill to build now If you maintain an Origin integration, create a staging test matrix with two installations: one configured for all repositories and one configured for selected repositories. Confirm that Create Repo succeeds only for the former, then test the workspace administrator re-approval path for an existing installation. For Get Repo Tarball, make the client follow the 302 response and validate that the complete flow works from an address permitted by the namespace inbound IP allowlist. ## Reader takeaway Origin’s API now documents repository creation for appropriately scoped, all-repository app installations, alongside a redirect-based archive-download flow. The capability is useful only when a team designs for its conditions: administrative re-approval, broader installation access, redirect handling, and network allowlist enforcement. Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json ## Continue in the graph Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`. - topic hub: [Api Design](https://newruntime.com/topics/api-design.md): Explore the api-design topic hub. - topic hub: [Developer Tools](https://newruntime.com/topics/developer-tools.md): Explore the developer-tools topic hub. - collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis. - collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites. - whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)