Every endpoint this instance declares under /api, 194 of them, generated from the
actions that implement them rather than written beside them. A hand-written reference is a
second description of the same thing, and the second one is the one that goes stale.
Authentication is a bearer token unless an endpoint says otherwise:
A token carries scopes, and a repository the token cannot reach answers 404 rather than
403 - saying "forbidden" would confirm that a private repository exists.
204 of the 216 operations below declare their inputs on the action, and this page
lists them. The rest validate inside the handler, so the page names the action instead of
guessing - that number going up is the work, and a test holds it from going down.
Generated from OpenAPI 1.0.0.
Audit
GET /api/audit
Name
In
Required
Type
organization_id
query
optional
number
actor_id
query
optional
number
owner
query
optional
string
repo
query
optional
string
action
query
optional
string
since
query
optional
string
until
query
optional
string
limit
query
optional
number
before
query
optional
number
format
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
Auth
POST /api/auth/atproto
Name
In
Required
Type
identifier
body
required
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/auth/atproto/callback
Name
In
Required
Type
state
query
optional
string
code
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/auth/login
Name
In
Required
Type
code
body
optional
string
email
body
optional
string
next
body
optional
string
passkey
body
optional
string
password
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/auth/logout
Inputs are not declared on Actions/Auth/LogoutAction, so they are not listed here.
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/auth/password/reset
Name
In
Required
Type
email
body
optional
string
operation
body
optional
string
password
body
optional
string
token
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/auth/register
Name
In
Required
Type
email
body
optional
string
handle
body
optional
string
name
body
optional
string
next
body
optional
string
password
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/auth/sso
Name
In
Required
Type
code
query
optional
string
next
query
optional
string
state
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/auth/verify
Name
In
Required
Type
id
query
optional
number
token
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/auth/verify/resend
Name
In
Required
Type
id
body
optional
number
token
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/auth/{provider}
Name
In
Required
Type
provider
path
required
string
next
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/auth/{provider}/callback
Name
In
Required
Type
provider
path
required
string
code
query
optional
string
state
query
optional
string
error
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/auth/{provider}/callback
Name
In
Required
Type
provider
path
required
string
code
body
optional
string
state
body
optional
string
error
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
Discover
GET /api/discover
Name
In
Required
Type
before
query
optional
number
Status
Means
200
The newest events first, and the cursor to ask for the ones before them.
422
Validation failed
500
Server error
Explore
GET /api/explore
Name
In
Required
Type
topic
query
optional
string
language
query
optional
string
days
query
optional
number
Status
Means
200
Successful response
422
Validation failed
500
Server error
Featured
GET /api/featured
Name
In
Required
Type
limit
query
optional
number
Status
Means
200
Successful response
422
Validation failed
500
Server error
Feed
GET /api/feed
Name
In
Required
Type
before
query
optional
custom
Status
Means
200
Successful response
422
Validation failed
500
Server error
Gh
POST /api/gh/repos/{owner}/{repo}/issues/{number}/comments
Name
In
Required
Type
owner
path
required
string
repo
path
required
string
number
path
required
string
owner
body
optional
string
repo
body
optional
string
resource
body
optional
string
sha
body
optional
string
number
body
optional
number
Status
Means
200
Successful response
201
Created, in the shape Octokit expects: an id and the fields it sent back.
401
No credential, or one this instance does not recognise.
404
No such repository, or a resource this surface does not implement - the body names the three that exist.
422
Missing something GitHub would require too: head_sha, state, or body.
Not an administrator. The endpoint does not admit it exists.
422
The operation needs something it was not given.
500
Server error
POST /api/instance/settings
Name
In
Required
Type
key
body
optional
string
value
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
Mcp
POST /api/mcp
Inputs are not declared on Mcp/McpAction, so they are not listed here.
Status
Means
200
Successful response
422
Validation failed
500
Server error
Metrics
GET /api/metrics
Inputs are not declared on Actions/Ops/MetricsAction, so they are not listed here.
Status
Means
200
Successful response
422
Validation failed
500
Server error
Mirrors
POST /api/mirrors/sync
Name
In
Required
Type
owner
body
optional
string
repo
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/mirrors/webhook
Inputs are not declared on Actions/Mirror/MirrorWebhookAction, so they are not listed here.
Status
Means
200
Successful response
422
Validation failed
500
Server error
Og
GET /api/og
Name
In
Required
Type
path
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
Openapi.json
GET /api/openapi.json
Inputs are not declared on Actions/Api/OpenApiAction, so they are not listed here.
Status
Means
200
Successful response
422
Validation failed
500
Server error
Operations
GET /api/operations/{id}
Name
In
Required
Type
id
path
required
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/operations/{id}/cancel
Name
In
Required
Type
id
path
required
string
id
body
optional
custom
Status
Means
200
Successful response
422
Validation failed
500
Server error
Orgs
DELETE /api/orgs
Name
In
Required
Type
confirm
query
optional
string
organization_id
query
optional
custom
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/orgs
Name
In
Required
Type
billing_email
body
optional
string
description
body
optional
string
handle
body
optional
string
name
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
PUT /api/orgs
Name
In
Required
Type
handle
body
optional
string
organization_id
body
optional
custom
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/orgs/delete
Name
In
Required
Type
confirm
body
optional
string
organization_id
body
optional
custom
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/orgs/machine-accounts
Name
In
Required
Type
handle
body
optional
string
name
body
optional
string
organization_id
body
optional
custom
Status
Means
200
Successful response
422
Validation failed
500
Server error
DELETE /api/orgs/members
Name
In
Required
Type
organization_id
query
optional
custom
user_id
query
optional
number
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/orgs/members
Name
In
Required
Type
handle
body
optional
string
organization_id
body
optional
custom
role
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/orgs/members/accept
Name
In
Required
Type
operation
body
optional
string
organization_id
body
optional
custom
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/orgs/members/remove
Name
In
Required
Type
organization_id
body
optional
custom
user_id
body
optional
number
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/orgs/members/role
Name
In
Required
Type
organization_id
body
optional
custom
role
body
optional
string
user_id
body
optional
number
Status
Means
200
Successful response
422
Validation failed
500
Server error
PUT /api/orgs/members/role
Name
In
Required
Type
organization_id
body
optional
custom
role
body
optional
string
user_id
body
optional
number
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/orgs/teams
Name
In
Required
Type
description
body
optional
string
name
body
optional
string
operation
body
optional
string
organization_id
body
optional
custom
parent_team_id
body
optional
custom
slug
body
optional
string
team_id
body
optional
custom
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/orgs/teams/members
Name
In
Required
Type
operation
body
optional
string
role
body
optional
string
team_id
body
optional
custom
user_id
body
optional
number
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/orgs/tokens
Name
In
Required
Type
organization_id
query
optional
custom
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/orgs/update
Name
In
Required
Type
handle
body
optional
string
organization_id
body
optional
custom
Status
Means
200
Successful response
422
Validation failed
500
Server error
Owners
GET /api/owners
Name
In
Required
Type
owner
query
required
string
q
query
optional
string
page
query
optional
number
per_page
query
optional
number
Status
Means
200
The owner, one page of their repositories, and their profile README when they have written one.
404
No account or organization with that handle. An alias that has moved answers this too; follow /{handle} for the redirect.
422
Validation failed
500
Server error
Repos
DELETE /api/repos
Name
In
Required
Type
owner
query
required
string
repo
query
optional
string
repository
query
optional
string
confirm
query
optional
string
Status
Means
200
Deleted: the row and the repository on disk, together.
401
Unauthenticated.
403
Not yours to delete.
404
No such repository, or none this caller may see. A private repository answers this rather than 403, because a 403 confirms it exists.
422
The confirmation did not match the repository name. Deleting a repository takes the name, typed.
500
Server error
POST /api/repos
Name
In
Required
Type
owner
body
optional
string
default_branch
body
optional
string
description
body
optional
string
gitignore
body
optional
string
host
body
optional
string
license
body
optional
string
license_holder
body
optional
string
name
body
optional
string
readme
body
optional
custom
visibility
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
PUT /api/repos
Name
In
Required
Type
owner
body
optional
string
repo
body
optional
string
allow_merge_commit
body
optional
custom
allow_rebase_merge
body
optional
custom
allow_squash_merge
body
optional
custom
default_branch
body
optional
string
default_merge_strategy
body
optional
string
delete_branch_on_merge
body
optional
custom
description
body
optional
string
homepage
body
optional
string
is_archived
body
optional
custom
is_template
body
optional
custom
name
body
optional
string
visibility
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/repos/archive
Name
In
Required
Type
owner
query
optional
string
repo
query
optional
string
format
query
optional
string
ref
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
POST /api/repos/attachments
Name
In
Required
Type
owner
body
optional
string
repo
body
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/repos/badge
Name
In
Required
Type
owner
query
optional
string
repo
query
optional
string
workflow
query
optional
string
branch
query
optional
string
label
query
optional
string
Status
Means
200
The badge, as SVG. Grey unknown when there is nothing to report, whatever the reason.
304
Nothing has changed since the ETag the caller sent.
422
Validation failed
500
Server error
GET /api/repos/blame
Name
In
Required
Type
owner
query
optional
string
repo
query
optional
string
limit
query
optional
number
path
query
optional
string
ref
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/repos/blob
Name
In
Required
Type
owner
query
optional
string
repo
query
optional
string
path
query
optional
string
ref
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/repos/blob/rows
Name
In
Required
Type
owner
query
optional
string
repo
query
optional
string
count
query
optional
number
from
query
optional
custom
path
query
optional
string
ref
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/repos/branches
Name
In
Required
Type
owner
query
optional
string
repo
query
optional
string
ref
query
optional
string
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/repos/checks
Name
In
Required
Type
owner
query
required
string
repository
query
optional
string
sha
query
optional
string
number
query
optional
number
Status
Means
200
Every check on the commit, and the one state that follows from them.
401
No credential, or one this instance does not recognise.
404
No such repository, or one this caller may not see - deliberately the same answer, because distinguishing them tells a stranger that a private repository exists.
422
Neither a commit sha nor a pull request number was named.
The run as it now stands. ignored is present when a late report was refused because a later one had already been recorded - which is not an error from the reporter's side, so it is not answered as one.
201
A check run or commit status was created.
401
No credential, or one this instance does not recognise.
403
The caller may see this repository but not do this to it, or their token does not carry the permission.
404
No such repository, or one this caller may not see - deliberately the same answer.
422
A malformed sha, an unknown state, or a completed run with no conclusion.
A browser form was answered with a redirect back to the page it came from. Scripts get the JSON above.
401
Unauthenticated.
404
No such repository, or none this caller may see. A private repository answers this rather than 403, because a 403 confirms it exists.
422
The subscription is not one of all, participating or ignore.
500
Server error
PUT /api/repos/watches
Name
In
Required
Type
owner
body
required
string
repo
body
optional
string
repository
body
optional
string
subscription
body
optional
string
Status
Means
200
The subscription as it now stands.
302
A browser form was answered with a redirect back to the page it came from. Scripts get the JSON above.
401
Unauthenticated.
404
No such repository, or none this caller may see. A private repository answers this rather than 403, because a 403 confirms it exists.
422
The subscription is not one of all, participating or ignore.
500
Server error
POST /api/repos/webhooks
Name
In
Required
Type
owner
body
required
string
repo
body
optional
string
repository
body
optional
string
operation
body
optional
string
id
body
optional
number
url
body
optional
string
secret
body
optional
string
content_type
body
optional
string
active
body
optional
boolean
limit
body
optional
number
events
body
optional
custom
Status
Means
200
The webhook as it now stands, or its recent deliveries when operation is deliveries.
201
The webhook, with the secret shown once.
401
Unauthenticated.
403
Managing webhooks needs administration access to the repository.
404
No such repository or webhook, or none this caller may see.
422
A URL this instance will not deliver to, or an event name it does not send. The SSRF policy refuses loopback and private ranges unless the operator allowed the host.
500
Server error
POST /api/repos/webhooks/redeliver
Name
In
Required
Type
owner
body
optional
string
repo
body
optional
string
delivery_id
body
optional
custom
Status
Means
200
Successful response
422
Validation failed
500
Server error
GET /api/repos/workflow-metrics
Name
In
Required
Type
owner
query
optional
string
repo
query
optional
string
workflow
query
optional
number
days
query
optional
number
Status
Means
200
The aggregate numbers, with the window they are of.
401
No credential, or one this instance does not recognise.
403
The caller may see this repository but not do this to it, or their token does not carry the permission.
404
No such repository, or one this caller may not see - deliberately the same answer.
The run as it now stands. cancelled is false when it had already finished, which is not an error: cancelling something that ended a moment ago is an ordinary thing to do.
303
A browser gets its run page back. The same action serves the interface, so it answers HTML callers with a redirect.
401
No credential, or one this instance does not recognise.
403
The caller may see this repository but not do this to it, or their token does not carry the permission.
404
No such repository, or one this caller may not see - deliberately the same answer.
The job output after the cursor, and the cursor to pass next time. Unchanged when there is nothing new, rather than an empty page that looks like the end.
401
No credential, or one this instance does not recognise.
403
The caller may see this repository but not do this to it, or their token does not carry the permission.
404
No such repository, or a job that is not this one's - the job id is a number anybody can increment.
The image, inline, with the type its bytes say it is.
404
No artifact of that name in this run.
410
The artifact expired, or its stored copy is gone.
415
The bytes are not a format this will render in place. SVG is refused whatever it contains.
422
Validation failed
500
Server error
POST /api/repos/workflow-runs/pause
Name
In
Required
Type
owner
body
optional
string
repo
body
optional
string
number
body
optional
number
action
body
optional
string
Status
Means
200
The run as it now stands. changed is false when it was already in that state, which is not an error: two people pressing the same button is an ordinary afternoon.
303
A browser gets its run page back; the same action serves the interface.
401
No credential, or one this instance does not recognise.
403
The caller may see this repository but not do this to it, or their token does not carry the permission.
404
No such repository, or one this caller may not see - deliberately the same answer.
409
A run that has finished, or one on its way out through a cancellation, cannot be held.
Inputs are not declared on Actions/Pull/ReviewQueueAction, so they are not listed here.
Status
Means
200
Successful response
422
Validation failed
500
Server error
Runner
POST /api/runner/annotations
Name
In
Required
Type
summary
body
optional
string
context
body
optional
string
append
body
optional
boolean
Status
Means
200
How many annotations were recorded, and the check they belong to.
401
The job token is not one this instance issued, or the job is not running.
409
The runner speaks a protocol version this server does not.
422
Validation failed
500
Server error
POST /api/runner/artifacts
Takes no parameters.
Status
Means
200
Successful response
201
The artifact, with the digest a client can check what it downloads against and the date it stops being available.
401
No job credential, or one this instance does not recognise.
404
The credential names a job whose run has gone.
409
This run already has an artifact under that name with different content. Replacing it silently would leave two people holding different files with one name.
413
Past the per-artifact or per-run ceiling. The message says which and by how much.
422
Validation failed
426
This runner speaks a protocol version the server does not.
500
Server error
Response headers: X-Runner-Protocol-Supported.
POST /api/runner/artifacts/fetch
Name
In
Required
Type
name
body
optional
string
Status
Means
200
The bytes, with X-Artifact-Digest so the job can check them.
401
No job credential, or one this instance does not recognise.
404
This run has no artifact by that name - or it expired, which is the same answer to a job that needed it.
410
The row is here but the bytes are gone, which is a disk that lost them rather than a name that was wrong.
422
Validation failed
426
This runner speaks a protocol version the server does not.
500
Server error
Response headers: X-Artifact-Digest.
POST /api/runner/caches
Takes no parameters.
Status
Means
200
Successful response
201
Stored, with the scope it was actually written to - which is the run's own, whatever the runner assumed.
401
No job credential, or one this instance does not recognise.
403
The runner named a scope this run may not write to.
404
The credential names a job whose run has gone.
413
Past the snapshot ceiling. Above it a cache costs more to move than the install it replaces.
422
No body, no key, or a digest that is not a sha-256.
426
This runner speaks a protocol version the server does not.
500
Server error
GET /api/runner/caches/restore
Name
In
Required
Type
key
query
optional
string
Status
Means
200
The archive. X-Cache-Scope says whose it was and X-Cache-Exact whether it was this run's own rather than the fallback.
204
No snapshot for that key. A cold cache is not an error.
401
No job credential, or one this instance does not recognise.
404
The credential names a job whose run has gone.
422
No key.
426
This runner speaks a protocol version the server does not.