API reference

OpenAPI document

The Rails API generates the public control-plane contract. Use the canonical OpenAPI JSON for SDK generation, typed clients, or an interactive API client. Do not copy an API schema into prose where the generated contract is more precise.

API areas

• Authentication and current user session
• Organizations, members, and invitations
• Repository access and VCS operations
• Idempotent change submit, sync, lookup, and merge queues
• Import baselines for Git and GitHub adoption
• Hosting apps, environments, services, deployments, domains, CDN, and static sites
• Image repositories, registry tokens, and tag listing

Authorization and concurrency

Browser sessions and bearer tokens with repository access can access the relevant control-plane operations. Landing requests and queue mutations require repository write access; organization-admin operations are explicitly marked by their endpoints.

Successful personal-access-token identities are cached for up to 20 minutes to keep repeated API requests fast. Token revocation and changes to the cached user profile can take up to 20 minutes to reach every API worker. A cache entry never outlives the token's expiration time. Organization membership and repository permissions are checked separately from this identity cache.

Browser-session user identities use the same 20-minute cache window. Profile and account-access changes can take up to that long to become visible to an existing session. The browser session cookie must still be valid; signing out removes it from the browser.

Queue and merge-policy mutations use an optimistic expected version. A stale version returns 409 rather than silently overwriting concurrent work. See the CLI reference for task-oriented command forms over the same contract.