> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.cessy.ai/reference/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.cessy.ai/_mcp/server.

# Reference

> Reference index for Cessy Design MCP, Runtime MCP, authentication, generated APIs, permissions, adapters, field types, expressions, and operations.

Use reference pages when you need exact surface behavior. Use guides when you need workflow judgment.

## Design-time reference

| Page                                        | Use it for                                                                                     |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| [Design MCP](/reference/design-mcp)         | App-scoped design tools, read-only and full endpoints, OAuth scopes, and client setup context. |
| [MCP Reference](/reference/mcp-reference)   | Compare Design MCP and Runtime MCP tool surfaces.                                              |
| [Authentication](/reference/authentication) | Bearer tokens, OAuth scopes, actors, and webhook auth.                                         |

## Runtime reference

| Page                                                      | Use it for                                                                                                           |
| --------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| [Frontend SDK](/build-a-frontend/frontend-sdk-reference)  | Complete hosted `@ces/app-sdk` exports, auth/runtime-source behavior, agent selection, and SDK-versus-REST guidance. |
| [Runtime API](/extend-the-app)                            | Generated REST commands, projections, channel interaction, batch commands, event import, rebuild, and OpenAPI.       |
| [GraphQL API](/extend-the-app/graph-ql-api)               | Generated GraphQL command mutations and projection queries.                                                          |
| [Webhooks](/extend-the-app/webhooks)                      | Inbound external event handling.                                                                                     |
| [Subscriptions](/extend-the-app/subscriptions)            | Outbound event delivery by poll or SSE.                                                                              |
| [Projection Queries](/build-a-backend/projection-queries) | Filters, sorting, pagination, and output shaping.                                                                    |

## Modeling reference

| Page                                                  | Use it for                                                              |
| ----------------------------------------------------- | ----------------------------------------------------------------------- |
| [Field Types](/reference/field-types)                 | Common command, event, and projection field types.                      |
| [Expression Language](/reference/expression-language) | Guard, mapping, and policy expressions.                                 |
| [Permissions](/build-a-backend/permissions)           | Roles, attributes, principals, command execution, and projection reads. |
| [Adapters](/extend-the-app/adapters)                  | External service calls from controlled policy workflows.                |
| [Sandboxes](/reference/sandboxes)                     | Custom code execution boundaries.                                       |

## Generated API reference

The generated Runtime API block in this docs site is a template. For a real app, the canonical contract is:

```text
/api/rest/<tenant-id>/<app-id>/openapi
```

Always inspect the generated contract for the target app and environment before integrating.

> Reference index for Cessy Design MCP, Runtime MCP, authentication, generated APIs, permissions, adapters, field types, expressions, and operations.

## Docs

- [Design MCP](https://docs.cessy.ai/reference/design-mcp.md): Reference the Cessy Design MCP endpoints, OAuth scopes, tool families, and safe client usage for Claude, Codex, ChatGPT, and automation.
- [MCP Reference](https://docs.cessy.ai/reference/mcp-reference.md): Compare Cessy Design MCP and Runtime MCP surfaces for builder and runtime agent workflows.
- [Authentication](https://docs.cessy.ai/reference/authentication.md): Authenticate Cessy Runtime APIs, Design MCP, Runtime MCP, webhooks, subscriptions, adapters, and agent bridge calls.
- [Field Types](https://docs.cessy.ai/reference/field-types.md): Choose Cessy command, event, projection, and permission field types that make runtime validation and generated contracts predictable.
- [Expression Language](https://docs.cessy.ai/reference/expression-language.md): Use Cessy expressions for guards, mappings, policies, projections, and runtime configuration without unsafe dynamic code.
- [Sandboxes](https://docs.cessy.ai/reference/sandboxes.md): Use Cessy sandbox execution for controlled custom code while keeping business decisions in commands, events, projections, and policies.
- [API Versioning](https://docs.cessy.ai/reference/api-versioning.md): Evolve generated Cessy app contracts, platform-owned APIs, MCP tools, and docs without surprising builders or consumers.