Cursor Origin

By integrating Cursor Origin with DX, you can analyze pull requests and reviews from repositories hosted on Cursor’s own source control product. Please refer to the API documentation below and our schema explorer to see what data DX imports—note that DX does not read or access your source code.

Cursor Origin is a separate product from the Cursor connector, which imports Cursor AI usage metrics rather than source control data.

You can connect in either of two ways:

• DX marketplace app (recommended): install DX’s own Origin app on your Cursor namespace in a few clicks. There is no key pair to generate and nothing to copy between systems. DX only reads the repositories you approve during the install, and you can uninstall the app in Cursor at any time.
• Internal app: register your own Origin app in Cursor and give DX its App ID and private key.

Tables populated

These are the tables populated by this connector.

Use the schema explorer for column-level details in each table.

Prerequisites

To connect Cursor Origin to DX, you need admin access to install apps on the namespace(s) (user or organization) whose repositories you want to sync.

To use an internal app instead of the DX marketplace app, you also need:

• access to cursor.com/codebase/settings/apps to register an Origin App
• an Ed25519 key pair, used to sign the app’s authentication tokens

Setup instructions

Follow the steps below to connect Cursor Origin to DX.

Option 1: DX marketplace app

Step 1: Start the install from DX

• Navigate to the connections page in DX and select + Connection in the top right.
• Choose Cursor Origin as the connection type and DX marketplace app as the authentication method.
• Select Install Cursor Origin app. DX sends you to Cursor to approve the install.

Step 2: Approve the app in Cursor

In Cursor, choose the namespace (user or organization) to install the DX app on. You can grant access to all repositories in the namespace, or select specific ones.

DX asks for these read-only scopes, which are the minimum it needs:

DX never writes to Cursor Origin.

Step 3: Finish the connection in DX

After you approve the install, Cursor returns you to DX. Select Add connection to finish. DX ties the connection to that one installation, so it only ever reads the repositories you approved.

Option 2: Internal app

Step 1: Generate a key pair

Generate an Ed25519 key pair locally:

openssl genpkey -algorithm ED25519 -out origin-app-private.pem
openssl pkey -in origin-app-private.pem -pubout -out origin-app-public.pem

The private key must stay secret—do not upload it anywhere except into DX. Cursor only ever stores the public key.

Step 2: Create the Origin app

Go to cursor.com/codebase/settings/apps and create a new app. Paste the contents of origin-app-public.pem when prompted for a signing key.

Grant the following read-only scopes, which are the minimum DX needs:

Repo Contents: Read repository metadata is required by Origin and granted automatically, so you don’t need to select it. Leave every other permission unchecked (User Delegation, Codebase Settings, Repo Mirroring, Repo Settings, and all create, update, and delete options)—DX never writes to Cursor Origin.

Step 3: Copy the App ID

Copy the App ID shown on the app’s settings page—you’ll need it when creating the connection in DX.

Step 4: Install the app

From the app’s settings page, install it on each namespace (user or organization) whose repositories you want to sync. You can grant access to all repositories in the namespace, or select specific ones.

Step 5: Create the connection in DX

• Navigate to the connections page in DX and select + Connection in the top right.
• Choose Cursor Origin as the connection type and Internal app as the authentication method.
• Enter the App ID from step 3 and the private key file contents from step 1.

Webhooks

DX supports Cursor Origin webhooks ingestion to sync pull requests, reviews, and labels in real-time. This is recommended in order to ensure real-time data accuracy in DX.

Webhooks are available for connections that use an internal app.

To enable webhooks, open your internal app’s settings at cursor.com/codebase/settings/apps and set the Webhook URL to https://yourinstance.getdx.net/webhooks/cursor_origin, but with your unique subdomain. Cursor signs each delivery with its own keys, so there is no secret to enter.

Select these events in the app’s settings. A new Origin app is not subscribed to any repository events by default.

The installation.created, installation.updated, installation.suspended, installation.unsuspended, and installation.deleted events are always delivered by Cursor, so there is nothing to select for them. If the app is uninstalled or suspended, DX disables the connection until you reinstall or unsuspend it.

API reference

The table below lists the specific API endpoints that are used by DX, for both the DX marketplace app and internal apps.

Errors

The table below lists potential error codes when adding a connection in DX. The private_key_needed and invalid_pem errors apply to internal apps only.

Curl commands

When connection verification fails

These commands are for internal apps, where you hold the private key. For a DX marketplace app connection, contact DX support.

When DX verifies a Cursor Origin connection, it fetches the app’s installations and checks that at least one has the required scopes and repository access. If your connection is failing, you can test these endpoints directly using the commands below to troubleshoot the issue.

Step 1: Generate an app JWT

Cursor Origin app JWTs are signed with EdDSA (Ed25519), not RSA:

APP_ID="YOUR_CURSOR_ORIGIN_APP_ID"
PRIVATE_KEY_FILE="origin-app-private.pem"

b64url() { base64 | tr -d '\n=' | tr '+/' '-_'; }

HEADER=$(printf '{"alg":"EdDSA","kid":"%s","typ":"JWT"}' "$APP_ID" | b64url)
NOW=$(date +%s); EXP=$((NOW + 300))
PAYLOAD=$(printf '{"iat":%s,"exp":%s,"iss":"%s","aud":"origin-apps"}' "$((NOW - 60))" "$EXP" "$APP_ID" | b64url)

tmp=$(mktemp)
printf '%s' "$HEADER.$PAYLOAD" > "$tmp"
SIG=$(openssl pkeyutl -sign -inkey "$PRIVATE_KEY_FILE" -rawin -in "$tmp" | b64url)
rm -f "$tmp"

echo "$HEADER.$PAYLOAD.$SIG"

Step 2: Test endpoints

Replace YOUR_JWT_TOKEN with the token generated above before running these commands.

1. Test app installations

This verifies that your app can see its own installations:

curl -H 'Authorization: Bearer YOUR_JWT_TOKEN' 'https://api.cursor.com/v1/origin/app/installations'

2. Mint an installation access token

For each installation ID returned above, mint a token and confirm it has repository access:

curl -X POST -H 'Authorization: Bearer YOUR_JWT_TOKEN' 'https://api.cursor.com/v1/origin/app/installations/YOUR_INSTALLATION_ID/access_tokens'

The installations response should include a scopes array containing at least repository:pull_requests:read, repository:pull_requests:reviews:read, and repository:members:read, and no suspendedAt value. An installation token never outlives the JWT used to mint it—15 minutes at most, and only 5 minutes with the JWT generated above—so mint a fresh one for each test rather than reusing an old one.

If you receive a 401 error, your JWT may be invalid, expired, or signed with the wrong key. If you receive a 403 error or empty results, the app may not have the required scopes or may not be installed on any namespace.

Data Cloud API

Once the initial connection is created successfully, Cursor Origin credentials for internal apps can be managed via the Data Cloud API. DX marketplace app connections don’t store credentials in DX.

• credentials.create
• credentials.update
• credentials.info
• credentials.list
• credentials.delete

Cursor Origin credentials use the following fields:

{
  "id": 456,
  "settings": {
    "cursor_origin_app_id": "app_01m489vynee1xr3nhh41k140mw"
  },
  "secrets": {
    "ed25519_private_key_seed": "-----BEGIN PRIVATE KEY-----\nMIIEfakePrivateKeyContentHere\n-----END PRIVATE KEY-----"
  }
}