--- title: "Cursor Origin" description: "Use pull requests on Cursor Origin, including stacked pull requests, reviews and check runs." canonical_url: "https://forges.link/providers/cursor-origin" --- # Cursor Origin > Use pull requests on Cursor Origin, including stacked pull requests, reviews and check runs. The Cursor Origin provider works with pull requests on Origin, including stacked pull requests, together with their comments, reviews and check runs. It also covers repository contents and Origin App installations. Origin has no issues, discussions, releases or notifications.
Detail Value
Import forges/cursor-origin
Factories cursorOrigin() , cursorOriginLite()
Auth token , app , anonymous
The Cursor Origin provider is experimental. It uses the alpha Origin API `v1alpha1`, which is exported as `ORIGIN_API_VERSION` and can change. To learn what that means, see [Capabilities](https://forges.link/concepts/capabilities). ## Authentication The provider accepts a user access token or the credentials of an Origin App: ```ts import { cursorOrigin } from 'forges/cursor-origin' const forge = cursorOrigin({ auth: { type: 'token', token: process.env.CURSOR_AUTH_TOKEN! }, }).create() const app = cursorOrigin({ auth: { type: 'app', appId: 'app_01...', privateKey: process.env.ORIGIN_APP_PRIVATE_KEY!, installationId: 'i_01...', }, }).create() ``` A user access token is the value that the Origin CLI reads from `CURSOR_AUTH_TOKEN`. Personal Cursor API keys aren't Origin bearer tokens, so the provider doesn't accept them. For app authentication, `privateKey` is the Ed25519 private key of the app in PKCS#8 PEM format, and the provider uses it to sign an app JWT. If you pass an `installationId` as well, the provider creates installation tokens whenever it needs one. If you leave it out, the provider authenticates as the app itself. In that case, `installations.list()` lists the installations of the app, and `installations.provider(installation)` returns a provider for one of them. An app without an `installationId` can only use `installations`, so every other capability is unsupported for it. Origin's API has no anonymous access. If you leave out `auth`, the provider can only verify and translate webhook deliveries, which it checks against Origin's public signing keys: ```ts const receiver = cursorOrigin({}).create() const events = await receiver.webhooks.ingest(delivery) ``` ## Instance The instance is `origin.cursor.com`, which is the host that appears in clone URLs. The `baseUrl` defaults to `https://api.cursor.com`, and the provider appends `/v1/origin` itself. ## Stacked pull requests For a pull request in a stack, `thread.stack` contains the ID of the stack and the parent pull request. ## Merging Origin only supports the `merge` and `squash` methods. If you call `merge()` without a `method`, the provider reads the settings of the repository. When exactly one method is allowed, it uses that one. When both are allowed, it throws `MergeMethodRequiredError`. The `whenChecksPass`, `title` and `message` options aren't available. ## Review comments A comment that is anchored to a line in the diff is a review comment. Review comments appear in `threads.events()` as `review_comment` events, and `threads.comments()` doesn't return them. Origin doesn't link inline comments to the review that submitted them, so each review has `comments: false`. ## Webhooks Origin sends webhooks in the Standard Webhooks format, with these headers:
Header Content
webhook-id The delivery ID
webhook-timestamp The time of the delivery, in seconds
webhook-signature An Ed25519 signature over the hex SHA-256 of ..
Since these deliveries are signed with a key pair, there is no secret for you to configure, and the provider ignores `webhookSecret`. It verifies the signature against the public keys from the `/keys` endpoint, which it caches for ten minutes, and it rejects deliveries with a timestamp more than five minutes away from the current time. ```ts const forge = cursorOrigin({ auth }).create() const events = await forge.webhooks.ingest({ headers: request.headers, body: await request.text(), }) ``` Deliveries of `installation.*` events become `installation` events. You register hooks in the definition of your app, so the management methods of `webhooks` aren't available. ## Capabilities
Capability User token App installation App Without credentials
experimental ✅ ✅ ✅ ✅
sources.poll ❌ ❌ ❌ ❌
sources.webhook ✅ ✅ ✅ ✅
sources.subscribe ❌ ❌ ❌ ❌
repos.get experimental experimental ❌ ❌
users.get ❌ ❌ ❌ ❌
users.me ❌ ❌ ❌ ❌
users.sponsorable ❌ ❌ ❌ ❌
users.events ❌ ❌ ❌ ❌
repos.list unverified unverified ❌ ❌
repos.byOwner ❌ ❌ ❌ ❌
repos.labels ❌ ❌ ❌ ❌
repos.createLabel ❌ ❌ ❌ ❌
repos.milestones ❌ ❌ ❌ ❌
repos.collaborators ❌ ❌ ❌ ❌
repos.contributors ❌ ❌ ❌ ❌
repos.contributorStats ❌ ❌ ❌ ❌
repos.templates ❌ ❌ ❌ ❌
repos.permissionFor ❌ ❌ ❌ ❌
repos.addCollaborator ❌ ❌ ❌ ❌
repos.assignableUsers ❌ ❌ ❌ ❌
repos.reviewerCandidates ❌ ❌ ❌ ❌
repos.events ❌ ❌ ❌ ❌
orgs.teams ❌ ❌ ❌ ❌
orgs.teamMembers ❌ ❌ ❌ ❌
threads.get PR (experimental) PR (experimental) ❌ ❌
threads.list PR (experimental) PR (experimental) ❌ ❌
threads.getMany experimental experimental ❌ ❌
threads.events PR (experimental) PR (experimental) ❌ ❌
comments.list PR (experimental) PR (experimental) ❌ ❌
comments.get PR (unverified) PR (unverified) ❌ ❌
comments.edit PR (unverified) PR (unverified) ❌ ❌
comments.delete PR (unverified) PR (unverified) ❌ ❌
reactions.list ❌ ❌ ❌ ❌
notifications.list ❌ ❌ ❌ ❌
notifications.markRead ❌ ❌ ❌ ❌
notifications.markDone ❌ ❌ ❌ ❌
notifications.unsubscribe ❌ ❌ ❌ ❌
notifications.markAllRead ❌ ❌ ❌ ❌
notifications.markAllDone ❌ ❌ ❌ ❌
notifications.unreadCount ❌ ❌ ❌ ❌
writes.comment PR (experimental) PR (experimental) ❌ ❌
writes.upsertComment PR (unverified) PR (unverified) ❌ ❌
writes.close PR (experimental) PR (experimental) ❌ ❌
writes.reopen PR (experimental) PR (experimental) ❌ ❌
writes.create PR (unverified) PR (unverified) ❌ ❌
writes.update PR (unverified) PR (unverified) ❌ ❌
writes.setLabels PR (unverified) PR (unverified) ❌ ❌
writes.addLabels ❌ ❌ ❌ ❌
writes.removeLabels ❌ ❌ ❌ ❌
writes.setMilestone ❌ ❌ ❌ ❌
writes.react ❌ ❌ ❌ ❌
writes.setAssignees ❌ ❌ ❌ ❌
writes.requestReview PR (unverified) PR (unverified) ❌ ❌
writes.merge experimental experimental ❌ ❌
writes.approveAndMerge unverified unverified ❌ ❌
writes.transfer ❌ ❌ ❌ ❌
writes.markDuplicate ❌ ❌ ❌ ❌
subscriptions.get ❌ ❌ ❌ ❌
subscriptions.set ❌ ❌ ❌ ❌
installations ❌ ❌ unverified ❌
checks.thread PR (experimental) PR (experimental) ❌ ❌
checks.list unverified unverified ❌ ❌
checks.get ❌ ❌ ❌ ❌
checks.report ❌ ❌ ❌ ❌
checks.rerun ❌ ❌ ❌ ❌
ci.runs ❌ ❌ ❌ ❌
ci.run ❌ ❌ ❌ ❌
ci.jobs ❌ ❌ ❌ ❌
ci.job ❌ ❌ ❌ ❌
ci.log ❌ ❌ ❌ ❌
contents.file unverified unverified ❌ ❌
contents.tree unverified unverified ❌ ❌
contents.branches unverified unverified ❌ ❌
contents.tags unverified unverified ❌ ❌
contents.resolveRef unverified unverified ❌ ❌
contents.commits unverified unverified ❌ ❌
contents.commit unverified unverified ❌ ❌
contents.compare unverified unverified ❌ ❌
contents.commitFiles ❌ ❌ ❌ ❌
contents.threadFiles unverified unverified ❌ ❌
contents.threadCommits unverified unverified ❌ ❌
reviews.list experimental experimental ❌ ❌
reviews.get unverified unverified ❌ ❌
reviews.create unverified unverified ❌ ❌
reviews.submit ❌ ❌ ❌ ❌
reviews.approve unverified unverified ❌ ❌
reviews.reply ❌ ❌ ❌ ❌
reviews.resolveThread unverified unverified ❌ ❌
releases.list ❌ ❌ ❌ ❌
releases.get ❌ ❌ ❌ ❌
releases.latest ❌ ❌ ❌ ❌
releases.getByTag ❌ ❌ ❌ ❌
releases.downloadAsset ❌ ❌ ❌ ❌
releases.create ❌ ❌ ❌ ❌
releases.update ❌ ❌ ❌ ❌
webhooks.list ❌ ❌ ❌ ❌
webhooks.create ❌ ❌ ❌ ❌
webhooks.update ❌ ❌ ❌ ❌
webhooks.delete ❌ ❌ ❌ ❌
webhooks.rotateSecret ❌ ❌ ❌ ❌
webhooks.deliveries ❌ ❌ ❌ ❌
webhooks.redeliver ❌ ❌ ❌ ❌
search.threads ❌ ❌ ❌ ❌
search.repos ❌ ❌ ❌ ❌
search.commits ❌ ❌ ❌ ❌
search.code ❌ ❌ ❌ ❌
securityAlerts ❌ ❌ ❌ ❌
eventKinds native native native native
authKinds token , app , anonymous token , app , anonymous token , app , anonymous token , app , anonymous
limits unknown unknown unknown unknown
Support depends on the kind of credential: - `token` (User token): A user access token, as the Origin CLI reads from `CURSOR_AUTH_TOKEN` - `installation` (App installation): An app with an `installationId` - `app` (App): An app without an `installationId` ## Sitemap See the full [sitemap](https://forges.link/sitemap.md) for all pages.