Helm7
Start free

Documentation

Four pages. The quickstart gets you from a repository to a running application; the CLI and API pages are references you come back to, and test accounts covers how an agent signs in to test what you built. All 66 operations are defined once and generated into the API, the CLI and the MCP server, so the references below are built from those definitions rather than written alongside them.

Quickstart

A repository to a running application with a database, auth, storage and a domain. Shown twice: once as CLI commands, once as MCP tool calls.

CLI reference

Every command, generated from the same operation definitions as the API, so the two cannot disagree.

REST API reference

Every endpoint, its inputs, its scopes and whether it can be dry-run or undone. Generated from the catalogue.

Test accounts

Temporary users an agent or CI job signs in as. How to create, register, check out, rotate and delete them, and what the model never sees.

Workload identity

How a service on Helm7 gets a short-lived OIDC token, so another system can trust it without a long-lived key.

If you are a model, start here instead

/llms.txt is the whole surface in one plain-text file: the rules that prevent expensive mistakes, the resource graph, a typical first session, the error codes and every operation. It is generated from the same definitions as these pages.

The OpenAPI document lives at https://www.helm7.com/v1/openapi.json.

The shape of everything

One idea underneath all of it: a Product is an application and everything it needs to run. Delete the Product and everything under it goes with it.

Organization
  └── Product                     one application
        └── Environment           production | preview | development
              ├── Service         web | worker | cron
              ├── Database        Postgres 18, pgvector
              ├── Auth            GoTrue-compatible
              ├── Storage         S3-compatible buckets
              ├── Domain          custom hostname and certificate
              ├── Secret          write-only environment variables
              └── Context         memory for the agents operating it

Something missing?

The documentation is thin in places, and we would rather you told us than guessed. Email [email protected].

Three ways in, one surface

The dashboard, the CLI and the MCP server all call the same operations, so anything you can click you can script, and anything a script can do an agent can do with the same limits. If a guide shows a CLI command, the API reference shows the request behind it.

Conventions worth knowing

  • Every operation that changes infrastructure takes dry_run: true and returns what would change and what it would cost per month.
  • Destructive operations refuse without confirm: true, and the refusal returns the same plan a dry run would.
  • Anything that creates or spends takes an idempotency_key, so a retry returns the original result rather than acting twice.
  • Secret values are never readable through any endpoint. Listing secrets gives names and fingerprints.
  • Every failure returns a stable error code, a remedy and a request_id. Branch on the code, never the message.