---
title: "Create function"
method: POST
path: "/v1/functions"
tags: ["Functions"]
---

# Create function

`POST /v1/functions`

Create a new Zavu Function. The function starts in `draft` status. A dedicated API key is auto-provisioned and injected as the `ZAVU_API_KEY` secret so the function can call back into the Zavu API without manual setup.

Provide `sourceCode` to seed the draft. Call `POST /v1/functions/{functionId}/deploy` afterwards to publish.

## Request body

- FunctionCreateRequest
  - `slug` string, required — URL-safe identifier (lowercase, digits, hyphens). Must be unique per project.
  - `name` string, required
  - `description` string
  - `runtime` 'nodejs24' — Runtime the function is deployed on.
  - `timeoutSec` integer — Per-invocation timeout in seconds. Event and cron invocations are asynchronous, so a long timeout only bounds cost; a tool called during a live conversation holds up the reply, and a function exposed over HTTP is additionally bounded by the platform's HTTP response limit.
  - `memoryMb` 128 | 256 | 512 | 1024
  - `httpEnabled` boolean — Whether to expose a public HTTPS URL for this function.
  - `sourceCode` string — TypeScript source code for the function entry point (max ~900KB).
  - `dependencies` object — npm dependencies. Keys are package names, values are semver ranges.

## Response `201`

Function created.

- ZavuFunctionResponse
  - `function` ZavuFunction, required — A Zavu Function — user-supplied TypeScript that runs in Zavu Cloud and reacts to messaging events or HTTP requests.
    - `id` string, required
    - `slug` string, required — URL-safe identifier, unique per project.
    - `name` string, required
    - `description` string, nullable
    - `runtime` 'nodejs24', required — Runtime the function is deployed on.
    - `status` 'draft' | 'bundling' | 'deploying' | 'active' | 'failed' | 'disabled', required — Lifecycle status of a Zavu Function.
    - `timeoutSec` integer, required — Per-invocation timeout in seconds.
    - `memoryMb` integer, required — Memory allocation in MB.
    - `httpEnabled` boolean, required — Whether the function can be invoked over HTTPS via its public URL.
    - `publicUrl` string, uri, nullable — HTTPS endpoint, present only while httpEnabled is true. Null otherwise, including for a function that was previously exposed — the stored URL stops serving the moment HTTP is turned off, so it is never returned.
    - `dependencies` object, required — npm dependencies installed in the function bundle. Keys are package names, values are semver ranges.
    - `activeDeploymentId` string, nullable — ID of the deployment currently serving traffic.
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `400` — Invalid request (e.g. duplicate slug, invalid dependencies).
- `401` — Unauthorized.

---

[API](https://skmtc.net/zavudev/apis/zavu-unified-messaging-layer-api.md) · [All operations](https://skmtc.net/zavudev/apis/zavu-unified-messaging-layer-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/zavudev/zavu-unified-messaging-layer-api/revisions/07b87b6ae707/schema)