> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usehasp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Bootstrap the app

> The signed-in user, their org and app role, the app, and the Data API limits
that apply to it. Called with the runtime session; a public app also answers
an anonymous caller, with `user: null` and the `viewer` role.



## OpenAPI

````yaml /openapi/data-v1.json get /bootstrap
openapi: 3.1.2
info:
  title: HASP Data API
  version: '2026-07-12'
  description: >-
    The HASP Data API reads and writes the records of an app's entities. Each
    entity's fields are declared in the

    app's schema (`GET /projects/{project}/schema`); a record is those fields
    plus `id`, `created_at`, and `updated_at`.

    Two app-level endpoints serve the runtime SDK: `GET /bootstrap` and `GET
    /status`, addressed by `X-Hasp-AppId`.


    Authenticate with a project API key (`Authorization: Bearer
    hasp_pak_live_…`), a delegated agent credential

    (`Bearer hasp_agt_live_…`), or — from the app itself — the runtime session
    cookie. Reads of a public app may be

    anonymous with an `X-Hasp-AppId` header naming the app. See

    [Authentication](https://docs.usehasp.com/ai-api/authentication#data-api).


    Errors use the same envelope as the AI API: `{"success": false, "error":
    {"type", "code", "message", "param",

    "details", "retryable", "request_id"}, "meta": {"request_id"}}`.
servers:
  - url: https://{org}.usehasp.run/api/hasp/v1
    description: App runtime origin
    variables:
      org:
        default: your-org
        description: Your organization's runtime subdomain.
security:
  - projectApiKey: []
  - agentCredential: []
  - runtimeSession: []
paths:
  /bootstrap:
    get:
      tags:
        - Bootstrap
      summary: Bootstrap the app
      description: >-
        The signed-in user, their org and app role, the app, and the Data API
        limits

        that apply to it. Called with the runtime session; a public app also
        answers

        an anonymous caller, with `user: null` and the `viewer` role.
      operationId: usehasp.bootstrap
      parameters:
        - name: X-Hasp-AppId
          in: header
          required: true
          description: The id of the published app to bootstrap.
          schema:
            type: string
      responses:
        '200':
          description: The caller's view of the app.
          content:
            application/json:
              schema:
                type: object
                properties:
                  user:
                    type:
                      - object
                      - 'null'
                    properties:
                      id:
                        type: string
                      name:
                        type: string
                      email:
                        type: string
                    required:
                      - id
                      - name
                      - email
                  org:
                    type: object
                    properties:
                      id:
                        type: string
                      role:
                        type: string
                    required:
                      - id
                      - role
                  role:
                    type: string
                  app:
                    type: object
                    properties:
                      id:
                        type: string
                      name:
                        type: string
                      type:
                        type: string
                    required:
                      - id
                      - name
                      - type
                  limits:
                    type: object
                    properties:
                      maxPageSize:
                        type: integer
                      maxRecordCount:
                        type: integer
                      rateLimitPerMinute:
                        type: integer
                    required:
                      - maxPageSize
                      - maxRecordCount
                      - rateLimitPerMinute
                required:
                  - user
                  - org
                  - role
                  - app
                  - limits
        '400':
          description: '`MISSING_APP_ID`: no `X-Hasp-AppId` header.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '401':
          description: '`UNAUTHENTICATED`: no signed-in user, and the app is not public.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '403':
          description: '`FORBIDDEN`: the signed-in user has no access to the app.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '404':
          description: '`NOT_FOUND`: no app has this id.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '423':
          description: >-
            `ORG_FROZEN`: HASP has frozen the app's organization during an
            incident; requests are refused until it is unfrozen.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      security:
        - runtimeSession: []
        - {}
components:
  schemas:
    ApiError:
      type: object
      properties:
        success:
          type: boolean
          enum:
            - false
        error:
          type: object
          properties:
            type:
              type: string
              description: The error category.
            code:
              type: string
              description: >-
                Stable machine-readable code; branch on this. See
                https://docs.usehasp.com/ai-api/reference/errors.
            message:
              type: string
            param:
              type:
                - string
                - 'null'
              description: The first input path at fault, when there is one.
            details:
              type:
                - object
                - 'null'
              description: >-
                Validation failures keyed by input path (`data.title`,
                `records.3.title`, `filter.age`).
              additionalProperties:
                type: array
                items:
                  type: string
            retryable:
              type: boolean
            request_id:
              type: string
          required:
            - type
            - code
            - message
            - retryable
            - request_id
        meta:
          type: object
          properties:
            request_id:
              type: string
          required:
            - request_id
      required:
        - success
        - error
        - meta
      title: ApiError
  securitySchemes:
    projectApiKey:
      type: http
      description: Project API key, for server-to-server access to one project.
      scheme: bearer
      bearerFormat: hasp_pak_{live|test}_…
    agentCredential:
      type: http
      description: Delegated agent credential, scoped by its authorization grants.
      scheme: bearer
      bearerFormat: hasp_agt_{live|test}_…
    runtimeSession:
      type: apiKey
      description: >-
        The signed-in user's session on the app runtime host; what the JS SDK
        uses.
      in: cookie
      name: hasp-runtime-session

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.