Management API

Overview#

The Management API lets a script or coding agent read your flows and edit their content without opening the dashboard. It is the API behind workflows like “update the paywall copy and let me preview it on my phone.”

It is a separate lane from the endpoints your app calls. The SDK endpoints authenticate a single app with X-App-Key and serve published content to devices. The Management API authenticates you with a personal key and can reach every app you have access to.

Authentication#

Create a key in the dashboard under Account → API Keys. The secret is shown once at creation and stored only as a hash, so save it somewhere safe. Pass it as a bearer token:

curl https://mobana.ai/api/manage/apps \
  -H "Authorization: Bearer mb_your_key_here"

Keys are scoped to your user account and carry either read or read + write permission. Permissions combine with your role on each app: a read-write key still cannot modify an app you were invited to as a viewer.

Base URL#

https://mobana.ai/api/manage

Unlike the SDK endpoints, this API is served only from the main domain. Your app subdomain will not answer management requests.

Endpoints#

Flows are addressed by app ID and flow slug — the same slug you pass to startFlow(). Versions are addressed by their ID.

Listing apps#

Start here to turn a key into an app ID:

{
  "apps": [
    {
      "id": "a1b2c3d4e5f6a7b8",
      "name": "My App",
      "role": "OWNER",
      "createdAt": "2026-01-13T18:13:09.497Z"
    }
  ]
}

role is OWNER, MANAGER, or VIEWER. A viewer's key is read-only on that app no matter what the key itself allows. App keys used by the SDK are never returned here.

Working with versions#

{
  "versions": [
    {
      "id": "clx8f2k1a0001pb7d9xk2m3n4",
      "previewId": "clx8f2k1a0001pb7d9xk2m3n4",
      "version": 4,
      "status": "DRAFT",
      "isActive": false,
      "weight": 1,
      "name": "with confetti",
      "changelog": null,
      "createdAt": "2026-02-01T10:00:00.000Z",
      "updatedAt": "2026-02-01T10:42:00.000Z",
      "publishedAt": null
    }
  ]
}

Editing a draft

Send only the fields you want to change. Any subset of html, css, js, name, and changelog is accepted:

curl -X PATCH \
  "https://mobana.ai/api/manage/apps/APP_ID/flows/paywall/versions/VERSION_ID" \
  -H "Authorization: Bearer mb_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "css": ".cta { background: #6d28d9; }" }'

One draft at a time

Creating a draft when one is already open returns 409 along with the existing draft, so you can continue that work instead of piling up abandoned versions:

{
  "error": "An open draft already exists for this flow.",
  "code": "DRAFT_EXISTS",
  "draft": {
    "id": "clx8f2k1a0001pb7d9xk2m3n4",
    "previewId": "clx8f2k1a0001pb7d9xk2m3n4",
    "version": 4,
    "status": "DRAFT",
    "updatedAt": "2026-02-01T10:42:00.000Z"
  }
}

Add ?force=true if you genuinely want a second draft.

The usual loop#

Most automated editing follows the same shape:

# 1. Find the app
GET  /api/manage/apps

# 2. Find the flow
GET  /api/manage/apps/{appId}/flows

# 3. Look for an open draft
GET  /api/manage/apps/{appId}/flows/{slug}/versions?status=DRAFT

# 4a. Draft exists — keep editing it
PATCH /api/manage/apps/{appId}/flows/{slug}/versions/{versionId}

# 4b. No draft — branch one off the live version
POST /api/manage/apps/{appId}/flows/{slug}/versions
     { "cloneFromVersionId": "{publishedVersionId}" }

# 5. A human reviews and publishes in the dashboard

Between steps 4 and 5 you can preview the draft on a real device using its previewId, without publishing anything. See startFlow().

Errors#

Errors return a message and, where useful, a stable code you can branch on:

{
  "error": "Version 3 is published and cannot be edited. Create a new draft instead.",
  "code": "NOT_A_DRAFT"
}

Inaccessible apps return 404 rather than 403, so IDs cannot be probed with a valid key.