API reference

Paths come from the OpenAPI document that the API exports from its route definitions (CI fails if it is stale); this site checks its list against that file. The public registry search and package reads and the health checks work anonymously; most other operations need a signed-in session or an API key.

• Public registry and blobs5 operations

  Anonymous search and package pages, plus content-addressed blob storage.

• Packages19 operations

  Create packages, publish immutable versions, manage assets, approvals, render previews and reviews.

• Workspaces10 operations

  Workspace desired state: targets, revisions, the manifest the CLI pulls, overrides and policies.

• Authentication4 operations

  Device authorization flow, token refresh and the current identity.

• API keys3 operations

  Scoped bearer credentials for one user in one organization.

• Webhooks7 operations

  Signed HTTPS deliveries of domain events, with retries and redelivery.

• Reviews1 operation

  Read an advisory AI review by id.

• Telemetry6 operations

  Ingest CLI telemetry events and read sync, adoption, provider, drift and failure aggregates.

• Administration10 operations

  Teams and members, org policies and the audit log.

• Onboarding2 operations

  Create an organization and the first membership for a new signup.

• Health2 operations

  Liveness and dependency health checks.