SDK & REST API Reference

Every capability in the Exovon web console is backed by our programmable control plane. Build custom CI/CD integrations, empower autonomous AI coding agents, manage serverless databases, or stream live container build logs using the official @exovon/sdk and unified REST API.

Full TypeScript SDK

Zero-dependency, fully typed TypeScript client supporting Node.js 18+, Bun, Deno, and Edge environments.

Live Event Streaming

Stream real-time build logs, container health metrics, and canary traffic shifts directly over Server-Sent Events (SSE).

Fine-Grained Scopes

Provision restricted Machine-to-Machine (M2M) API keys with read-only logs, project-isolated deploys, or database-only permissions.

1. Installation & Client Setup

Install the official client library in your application or CLI tools:

Terminal

# Install via npm
npm install @exovon/sdk

# Or execute CLI commands without local installation
npx exovon --help

Initialize the client with your secret API key. Keys can be created from your workspace in Project Settings → API Keys:

Client Initialization

import { ExovonClient } from '@exovon/sdk';

// Automatically loads process.env.EXOVON_API_KEY if omitted
const exovon = new ExovonClient({
  apiKey: process.env.EXOVON_API_KEY, // Format: exo_live_...
  maxRetries: 3, // Auto-retries with static Idempotency-Key
});

// Verify identity securely (zero token leakage)
const user = await exovon.whoami();
console.log(`Authenticated user ID: ${user.uid} (${user.tier})`);

2. Core SDK Operations

Programmatic Deployments & Orchestration

Deploy full workspaces locally or from CI/CD with automatic packaging and security exclusions:

Deploy Workspace

// Deploy current directory with progress streaming
const deployment = await exovon.deployments.deploy({
  projectId: 'proj_01J8ABC123',
  sourceDir: './', // Automatically applies .gitignore and .exovonignore
  framework: 'nextjs', // 'static' | 'nextjs' | 'vite' | 'astro'
  buildCommand: 'npm run build',
  outputDir: '.next',
}, (status) => {
  console.log(`[deploy] ${status}`);
});

console.log(`Deployment ready: ${deployment.url}`);

Infrastructure & Serverless Databases

Dynamically provision isolated PostgreSQL instances or secure storage for your projects:

Provision Database

// Provision managed ExoStore PostgreSQL instance
const db = await exovon.infrastructure.provisionDatabase(
  'proj_01J8ABC123',
  { type: 'postgres' }
);

// Credentials automatically bound to project secrets (DATABASE_URL)
console.log('PostgreSQL cluster provisioned successfully.');

Instant Traffic Rollback

Instantly switch the Edge Router traffic pointer to any previously healthy deployment in under 3 seconds:

Rollback Deployment

// Roll back to an explicit target deployment:
const result = await exovon.deployments.rollback('proj_01J8ABC123', 'dep_prev_stable_789');
console.log(result.success); // true
console.log(result.deployId); // 'dep_prev_stable_789'

// Or omit target to auto-revert to the last stable deployment:
const auto = await exovon.deployments.rollback('proj_01J8ABC123');
console.log(auto.message);

3. REST API Specification

The base URL for all production API calls is https://api.exovon.in/v1. Include your API key in the standard HTTP header:

Authorization: Bearer exo_live_9b4e872c1a0f443b8e90...

Method	Endpoint	Description	Scope Required
POST	/deployments	Trigger a new static or containerized deployment	deployments:write
GET	/deployments/:id	Retrieve status, health metrics, and active URL	deployments:read
GET	/deployments/:id/logs	Stream build and runtime container logs (SSE)	logs:read
POST	/projects/:id/rollback	Instant zero-downtime routing pointer rollback	deployments:rollback
POST	/database/query	Execute parameterized SQL over HTTP	database:query
POST	/domains	Attach custom domain and initiate SSL provisioning	domains:write
GET	/projects/:id/env	List configured environment variables (values masked)	env:read
PUT	/projects/:id/env	Batch update encrypted environment variables	env:write

4. Webhooks & HMAC Signature Verification

Exovon sends event notifications for deployment state changes, domain SSL renewals, and automated canary alerts. Every webhook payload is signed with an HMAC-SHA256 digest in the X-Exovon-Signature header.

Webhook Signature Verification

import crypto from 'crypto';

function verifyWebhookSignature(rawBody: string, signatureHeader: string, secret: string): boolean {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signatureHeader),
    Buffer.from(expectedSignature)
  );
}

5. Speed Insights & Real User Monitoring (`@exovon/sdk/react`)

Collect Google Core Web Vitals ($p75$ LCP, INP, CLS, TTFB) from client browsers with zero configuration and zero API keys. The telemetry is automatically intercepted by the Exovon Edge Router at /_exovon/vitals.

Root Layout Integration

// app/layout.tsx (Next.js) or src/App.tsx (Vite / React)
import { SpeedInsights } from '@exovon/sdk/react';

export default function RootLayout({ children }: { children: React.ReactNode }) {
  return (
    <html lang="en">
      <body>
        {children}
        <SpeedInsights />
      </body>
    </html>
  );
}

Zero API Key Architecture

Do not pass administrative API keys to <SpeedInsights />. Telemetry runs anonymously and is mapped by the edge router based on your domain.

6. HTTP Status Codes & Rate Limits

Default Rate Limits

REST API: 120 requests / minute per API key
Deployments: Max 10 concurrent active builds per workspace
SQL HTTP Queries: 500 requests / minute burst capacity
Headers returned: X-RateLimit-Remaining and Retry-After

Standard Error Response Format

{
  "error": "RESOURCE_NOT_FOUND",
  "message": "Project proj_01J8 does not exist",
  "statusCode": 404,
  "requestId": "req_mumbai_98f1a..."
}

Frequently Asked Questions

Can I use @exovon/sdk inside Edge Runtime functions?

Yes. The SDK is built using standard Web Fetch and Web Crypto APIs with zero Node.js native binary dependencies, making it fully compatible with Edge Workers, Cloudflare, and Next.js Edge Runtime.

How do I regenerate a compromised API key?

Visit your Project Settings -> API Keys in the dashboard. Click 'Revoke' immediately on the compromised token. Revocation takes effect across all global edge nodes within 500 milliseconds.

Was this documentation page helpful?

PreviousSpeed Insights & Web Vitals Next Account & API Keys

Pricing & Limits·System Status·Astrolabe AI IDE·CLI & SDK·99.95% SLA