create_app and update_app now take permission scopes as strings

The create_app and update_app mutations now take new input types, CreateAppInputV2 and UpdateAppInputV2. The input argument of create_app changed from CreateAppInput! to CreateAppInputV2!, and the input argument of update_app changed from UpdateAppInput! to UpdateAppInputV2!. The old CreateAppInput and UpdateAppInput types are no longer in the schema.

The only difference between the old and new input types is the permissions field. It was a list of the AppPermission enum ([AppPermission!]) and is now a list of plain strings ([String!]). The other fields (name, kind, description, slug, webhook_url and collaborators) are unchanged. On UpdateAppInputV2 every field is optional, as before. Read more about the mutations on the App reference page.

This is a breaking change for any request or typed client that references the old input types or sends permissions as enum values. API version 2026-10 still uses CreateAppInput, UpdateAppInput and AppPermission, so the change only affects requests that use version 2027-01 or later.

Migration notes

Before you move create_app and update_app requests to 2027-01:

• If you declare the input as a GraphQL variable, change its type from CreateAppInput! to CreateAppInputV2! (for create_app) and from UpdateAppInput! to UpdateAppInputV2! (for update_app).
• Send each entry of permissions as a string, for example permissions: ["docs:write", "me:read"], instead of an AppPermission enum value such as ME_READ. Each entry must be a valid permission scope, such as boards:read, and a request with an unknown scope is rejected. See the permission scopes your app can request.
• Regenerate any typed client or SDK types that reference CreateAppInput, UpdateAppInput or AppPermission for version 2027-01.

Before (2026-10)

mutation ($input: CreateAppInput!) {
  create_app(input: $input) {
    id
  }
}

{ "input": { "name": "My app", "permissions": ["ME_READ", "BOARDS_READ"] } }

After (2027-01)

mutation ($input: CreateAppInputV2!) {
  create_app(input: $input) {
    id
  }
}

{ "input": { "name": "My app", "permissions": ["me:read", "boards:read"] } }

The same change applies to update_app: declare the variable as UpdateAppInputV2! and send permissions as strings.

If you stay on 2026-10, nothing changes.