---
title: "Create Function"
method: POST
path: "/api/v1/functions"
tags: ["Function"]
---

# Create Function

`POST /api/v1/functions`

CreateFunction registers a new serverless function and creates its
 initial code commit. Functions run as TypeScript modules in a sandboxed
 runtime; see initial_content for the entry-file signature and SDK import.

 The new function is unpublished. To make the commit the default
 runnable version (and have the function appear as runnable in the
 Functions UI), call UpdateFunction with function.published_commit_id
 set and update_mask=["published_commit_id"].

## Request body

- C1ApiFunctionsV1FunctionsServiceCreateFunctionRequest — The FunctionsServiceCreateFunctionRequest message.
  - `commitMessage` string — The commit message describing the initial code submission.
  - `description` string — A description of what the function does.
  - `displayName` string — The human-readable name for the function.
  - `functionType` 'FUNCTION_TYPE_UNSPECIFIED' | 'FUNCTION_TYPE_ANY' | 'FUNCTION_TYPE_CODE_MODE' — The type of function to create. Use FUNCTION_TYPE_ANY for user functions — that is the type the Functions UI lists. Do not use any other value.
  - `initialContent` object — File map for the initial code commit. Keys are file paths in the function root (e.g. "main.ts", "main.test.ts"); values are file contents as bytes. Runtime: TypeScript. The entry file MUST be "main.ts" exporting a default async handler: import { JSONObject } from "@c1/functions-sdk"; export default async function main(input: JSONObject): Promise<JSONObject> { return { ok: true, echo: input }; } The handler MUST return a JSON object — not a primitive, array, or null.

## Response `200`

Successful response

- C1ApiFunctionsV1FunctionsServiceCreateFunctionResponse — The FunctionsServiceCreateFunctionResponse message.
  - `commit` C1ApiFunctionsV1FunctionCommit — FunctionCommit represents a single commit in a function's history
    - `author` string — The author field.
    - `createdAt` string, date-time, nullable
    - `functionId` string — The functionId field.
    - `id` string — The id field.
    - `message` string — The message field.
  - `function` C1ApiFunctionsV1Function — Function represents a customer-provided code extension in the API
    - `createdAt` string, date-time, nullable
    - `deletedAt` string, date-time, nullable
    - `description` string — The description field.
    - `displayName` string — The displayName field.
    - `functionType` 'FUNCTION_TYPE_UNSPECIFIED' | 'FUNCTION_TYPE_ANY' | 'FUNCTION_TYPE_CODE_MODE' — The functionType field.
    - `head` string — The head field.
    - `hookRefs` string[], nullable — IDs of every non-deleted hook that still references this function. Read-only: maintained by the Hook API, not by CreateFunction/UpdateFunction. Non-empty means DeleteFunction will refuse to delete until these are removed or retargeted.
    - `id` string — The id field.
    - `isDraft` boolean — The isDraft field.
    - `outboundNetworkAllowlist` string[], nullable — The outboundNetworkAllowlist field.
    - `provisionedConcurrency` integer — Number of pre-warmed Lambda instances. 0 (default) leaves the function cold-started on first invoke. > 0 reserves and provisions that many execution environments via AWS Lambda provisioned concurrency. Ignored for FUNCTION_TYPE_CODE_MODE functions — that value is driven by AIGovernanceSettings.code_mode_concurrency.
    - `publishedCommitId` string — The publishedCommitId field.
    - `scopedRoleIds` string[], nullable — Scoped role IDs define the permissions granted to this function when calling ConductorOne APIs. These are role IDs (not service roles) that get resolved to their service roles at authentication time. Currently only the "Read-Only Administrator" role (system:viewer) is supported. The role ID can be obtained from the roles API.
    - `secret` object — The secret field.
    - `updatedAt` string, date-time, nullable
    - `useSpn` boolean — FN-347 transition flag. When true, the function authenticates to c1-api as user:<sp_id> via the AssumeIdentity token exchange using its ServicePrincipalBinding; when false, it authenticates as function:<id>. Read-only from clients: set by CreateFunction (when the tenant has completed the FunctionsToSPN migration) and by the migration itself, never by UpdateFunction. Retired once all functions are on SPN.
    - `workflowTemplateRefs` string[], nullable — IDs of every non-deleted workflow template whose CallFunction step still references this function. Read-only, same semantics as hook_refs.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)