Skip to content

Endpoints

An overview of the REST API by resource. The complete, authoritative surface — request/response schemas included — is the OpenAPI specification.

GET /api/projects

POST /api/projects

GET /api/projects/{namespace}/{slug}

POST /api/projects/{namespace}/{slug}/import

DELETE /api/projects/{namespace}/{slug}

Permanently deletes a project and all associated data (repo + workspace forks, changes, issues, events, metrics, webhooks). Owner-only. The request body must confirm the exact path:

{ "confirm": "@namespace/slug" }

Returns 202 Accepted with { "status": "deleting", "jobId": "del_…" } — the cascade runs asynchronously and is idempotent/resumable. A mismatched confirm returns 400; a non-owner returns 404.

GET /api/projects/{namespace}/{slug}/workspaces

POST /api/projects/{namespace}/{slug}/workspaces

POST /api/workspaces/{name}/commit

GET /api/projects/{name}/changes

POST /api/projects/{name}/changes

POST /api/changes/{id}/merge

GET /api/agents

POST /api/agents

GET /api/agents/{id}

GET /api/users

Returns the authenticated user’s profile.

DELETE /api/users/me

GDPR-grade account erasure. Deletes the caller’s account and all owned projects, revokes all tokens/sessions (and the user’s agents), and anonymizes the user’s contributions to other people’s projects (author set to a deleted-user tombstone — the contribution stays, the identity is removed). Requires confirmation with the caller’s own username:

{ "confirm": "<your-username>" }

Setting deletion immediately invalidates the caller’s credentials (subsequent requests return 401). Returns 202 Accepted with { "status": "deleting", "jobId": "del_…" }; the cascade runs asynchronously and always completes (org sole-ownership is auto-resolved, never blocking erasure). A mismatched confirm returns 400.

GET /api/orgs

POST /api/orgs