---
url: /apps/reference.md
description: >-
  Generated-from-source reference for Civitai Apps — scopes, manifest, message
  bridge, React hooks, and the CLI.
---

> Documentation index: https://developer.civitai.com/llms.txt — every page on this site has a markdown version at its URL + `.md`.

# Reference

The pages in this section are **generated from pinned sources** rather than
hand-maintained. Each page states its exact source at the top. Not all of it is
regenerated on every build: a site build rebuilds the data behind the rendered
Scopes, Manifest, Messages, Hooks and CLI tables, but the Markdown copy of each
table committed in the page source (what `.md` and `llms.txt` readers get) is
refreshed by a maintainer running `npm run gen:appblocks:md`, and the Components
page is a committed file regenerated by hand. A pull-request check fails when a
committed Markdown copy no longer matches its generator.
Manifest, Hooks and the Messages payload shapes follow pinned `@civitai/*`
package releases; Scopes, the Messages page-only flags, Components and the CLI
follow committed snapshots of their sources (the `civitai` repo's constants, the
`@civitai/components` markup contract and the CLI's `--help`). Either way, an upstream change reaches these pages when the
site re-pins or re-snapshots.

| Page | What it covers | Source of truth |
|------|----------------|-----------------|
| [Scopes](https://developer.civitai.com/apps/reference/scopes.md) | The scope catalog: what each scope authorizes, its OAuth bit, and its binding | `civitai` block-scope constants |
| [Manifest](https://developer.civitai.com/apps/reference/manifest.md) | Every `block.manifest.json` field, type, and constraint | the published JSON Schema |
| [Components](https://developer.civitai.com/apps/reference/components.md) | The `@civitai/components` design-system pack: each component's `data-civitai-ui` name, attributes, and ARIA markup | the `@civitai/components` `MARKUP.md` contract |
| [Messages](https://developer.civitai.com/apps/reference/messages.md) | The full `postMessage` bridge protocol (payloads, directions, page-only) | `@civitai/app-sdk` + host parity inventory |
| [Hooks](https://developer.civitai.com/apps/reference/hooks.md) | Every `@civitai/blocks-react` hook: signature + example | `@civitai/blocks-react` types + README |
| [CLI](https://developer.civitai.com/apps/reference/cli.md) | The `civitai` CLI's App-authoring commands and flags | the Go `civitai` CLI (`civitai/cli`) |

## A note on authority

The generated tables describe the **shape** of the contract. The Civitai server
is the **enforcement boundary** — it validates more than these artifacts can
express (host allowlists, scope subsets, trust tiers). Where a generated page
and the server ever disagree, the server wins. Each page calls out the semantics
it can't capture.