> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.cessy.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.cessy.ai/_mcp/server.

# Reference

> Reference index for Cessy Design MCP, Runtime MCP, authentication, generated APIs, permissions, adapters, field types, expressions, and operations.

Use reference pages when you need exact surface behavior. Use guides when you need workflow judgment.

## Design-time reference

| Page                                        | Use it for                                                                                     |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| [Design MCP](/reference/design-mcp)         | App-scoped design tools, read-only and full endpoints, OAuth scopes, and client setup context. |
| [MCP Reference](/reference/mcp-reference)   | Compare Design MCP and Runtime MCP tool surfaces.                                              |
| [Authentication](/reference/authentication) | Bearer tokens, OAuth scopes, actors, and webhook auth.                                         |

## Runtime reference

| Page                                                      | Use it for                                                                                                           |
| --------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| [Frontend SDK](/build-a-frontend/frontend-sdk-reference)  | Complete hosted `@ces/app-sdk` exports, auth/runtime-source behavior, agent selection, and SDK-versus-REST guidance. |
| [Runtime API](/extend-the-app)                            | Generated REST commands, projections, channel interaction, batch commands, event import, rebuild, and OpenAPI.       |
| [GraphQL API](/extend-the-app/graph-ql-api)               | Generated GraphQL command mutations and projection queries.                                                          |
| [Webhooks](/extend-the-app/webhooks)                      | Inbound external event handling.                                                                                     |
| [Subscriptions](/extend-the-app/subscriptions)            | Outbound event delivery by poll or SSE.                                                                              |
| [Projection Queries](/build-a-backend/projection-queries) | Filters, sorting, pagination, and output shaping.                                                                    |

## Modeling reference

| Page                                                  | Use it for                                                              |
| ----------------------------------------------------- | ----------------------------------------------------------------------- |
| [Field Types](/reference/field-types)                 | Common command, event, and projection field types.                      |
| [Expression Language](/reference/expression-language) | Guard, mapping, and policy expressions.                                 |
| [Permissions](/build-a-backend/permissions)           | Roles, attributes, principals, command execution, and projection reads. |
| [Adapters](/extend-the-app/adapters)                  | External service calls from controlled policy workflows.                |
| [Sandboxes](/reference/sandboxes)                     | Custom code execution boundaries.                                       |

## Generated API reference

The generated Runtime API block in this docs site is a template. For a real app, the canonical contract is:

```text
/api/rest/<tenant-id>/<app-id>/openapi
```

Always inspect the generated contract for the target app and environment before integrating.