Apps

An app bundles one or more functions into a marketplace product with its own listing page, pricing model, install count, reviews — and one authorization surface a user grants capabilities to.

Pricing models

model	meaning
`FREE`	no purchase; calls are still metered to the caller at resource cost
`PAY_PER_USE`	the default — no purchase, callers pay per execution (metered + any per-function surcharge)
`ONE_TIME`	buy once (priceNanm), then pay-per-use at metered cost
`SUBSCRIPTION`	monthly ANM price for access, plus metered usage

Purchases settle with the same discipline as executions: the amount splits exactly into platform fee (at your snapshotted feeBps) and developer share, posted in one ledger transaction. Self-purchase is refused; a repeat purchase of an active ownership is a no-op, not a second charge.

purchase

# one-time purchase or subscription period, paid in ANM from the buyer's balance
POST /api/cloud/v1/apps/{slug}/purchase
# settles exactly-once: buyer debit, developer credit, platform fee — one transaction

User authorizations (grants)

Sensitive capabilities — SPEND_ANM, CALL_FUNCTION, CALL_APP, HTTP_FETCH — require the caller's explicit, revocable grant before an app can use them on the caller's behalf. A grant carries hard budget bounds, enforced atomically at every spend:

authorize an app

# the user's explicit, revocable grant for a sensitive-capability app
POST /api/cloud/v1/apps/{slug}/authorize
{
  "capabilities": ["SPEND_ANM"],
  "maxPerCallNanm": "1000000",
  "maxPerExecNanm": "5000000",
  "dailyCapNanm": "50000000",
  "allowedPayees": ["anim1…"],
  "expiresAt": null
}

maxPerCallNanm — per-payment cap · maxPerExecNanm — per-execution cap · dailyCapNanm — UTC-day cap (atomic claim: concurrent executions cannot double-spend the last allowance)
allowedPayees — recipient allowlist for animica.wallet.pay
Revocation (DELETE /api/cloud/v1/grants?id=…) takes effect on the very next host call — the executor re-reads the grant at every spend.

Reviews & discovery

Only genuine users may review: a review requires a purchase or at least one successful execution.
The public catalog (GET /api/cloud/v1/apps) sorts popularity by the real execution and install counters, which are refreshed transactionally at settlement — never invented.
Reports (POST /api/cloud/v1/reports) feed the moderation queue; suspended apps stop serving immediately (every execution checks the suspension flags).

Functions can exist without an app — an app is a storefront and permission boundary, not a deployment requirement. Attach functions to an app by passing appId when creating them.

← Functions Agents & schedules →