| 1 | --- |
| 2 | title: API reference |
| 3 | description: The REST API at api.g1t.sh, its authentication, errors and conventions, and a page for every endpoint. |
| 4 | --- |
| 5 | |
| 6 | The REST API lives at `https://api.g1t.sh`. It exposes the same operations |
| 7 | as the [MCP server](/reference/mcp/): every endpoint names the MCP tool and |
| 8 | action that do the same thing, with the same inputs. |
| 9 | |
| 10 | This page covers what every endpoint shares. The pages under each resource |
| 11 | in the sidebar document one endpoint each: its parameters, an example |
| 12 | request and response, and its errors. The machine-readable description is |
| 13 | at [api.g1t.sh/openapi.json](https://api.g1t.sh/openapi.json), and the |
| 14 | [explorer](/api/reference/) lets you call the API from the browser. |
| 15 | |
| 16 | ## Start at the root |
| 17 | |
| 18 | The API is public. Anything you could see on the site without signing in, |
| 19 | you can read without a token. `GET https://api.g1t.sh/` returns where |
| 20 | everything is, as URL templates: |
| 21 | |
| 22 | ```sh |
| 23 | curl https://api.g1t.sh/ |
| 24 | ``` |
| 25 | |
| 26 | ```json |
| 27 | { |
| 28 | "documentation_url": "https://docs.g1t.sh/reference/api/", |
| 29 | "openapi_url": "https://api.g1t.sh/openapi.json", |
| 30 | "mcp_url": "https://mcp.g1t.sh", |
| 31 | "current_user_url": "https://api.g1t.sh/user", |
| 32 | "repository_url": "https://api.g1t.sh/repos/{owner}/{name}", |
| 33 | "issues_url": "https://api.g1t.sh/repos/{owner}/{name}/issues{?state,label}", |
| 34 | "pulls_url": "https://api.g1t.sh/repos/{owner}/{name}/pulls{?state}" |
| 35 | } |
| 36 | ``` |
| 37 | |
| 38 | The response has more entries than shown here. |
| 39 | |
| 40 | ## Authentication |
| 41 | |
| 42 | A token is needed to change anything, and to see what is private. Send an |
| 43 | [access token](https://g1t.sh/settings/tokens) as a bearer token: |
| 44 | |
| 45 | ```sh |
| 46 | curl https://api.g1t.sh/user \ |
| 47 | -H "Authorization: Bearer $G1T_TOKEN" |
| 48 | ``` |
| 49 | |
| 50 | Public data can be read without a token. A token that is not valid is |
| 51 | rejected with `401` rather than treated as anonymous. Each endpoint's page |
| 52 | says whether it needs a token. |
| 53 | |
| 54 | A [workspace's own token](/guides/workspaces/#workspace-access-tokens) acts |
| 55 | as the workspace. The token g1t works with can use only the |
| 56 | operations its task needs, in its own repository. |
| 57 | |
| 58 | ### Scopes |
| 59 | |
| 60 | Each endpoint needs one [scope](/guides/authentication/#scopes), such as |
| 61 | `issues:read` to read an issue or `issues:write` to open one. Its page |
| 62 | says which, and the [OpenAPI document](https://api.g1t.sh/openapi.json) |
| 63 | gives it as `x-scope` on each operation, beside `x-mcp-tool` and |
| 64 | `x-mcp-action`, the MCP tool and action that do the same: |
| 65 | |
| 66 | ```json |
| 67 | { |
| 68 | "operationId": "get_issue", |
| 69 | "x-operation": "get_issue", |
| 70 | "x-mcp-tool": "issue", |
| 71 | "x-mcp-action": "get", |
| 72 | "x-scope": "issues:read" |
| 73 | } |
| 74 | ``` |
| 75 | |
| 76 | `x-scope` is `null` for `GET /user`, which any token may use. A token |
| 77 | needs the scope, and whoever it acts as needs a role that allows the call. |
| 78 | A token reaches every workspace and repository whoever it acts as can. |
| 79 | |
| 80 | ## Signing in from a tool |
| 81 | |
| 82 | A tool gets a token by having a person approve a short code in their |
| 83 | browser: [start signing in](/reference/api/accounts/device-code/), then |
| 84 | [finish signing in](/reference/api/accounts/device-token/). See |
| 85 | [signing in from a tool](/guides/authentication/#signing-in-from-a-tool). |
| 86 | |
| 87 | Applications that can open a browser use OAuth instead. See |
| 88 | [signing in with OAuth](/guides/authentication/#signing-in-with-oauth). |
| 89 | |
| 90 | | Method | Path | | |
| 91 | | --- | --- | --- | |
| 92 | | `GET` | `/.well-known/oauth-authorization-server` | Where the endpoints are. | |
| 93 | | `POST` | `/oauth/register` | Register a client. Body: `client_name`, `redirect_uris`. | |
| 94 | | `POST` | `/oauth/token` | Exchange a code, or refresh. Form-encoded or JSON. | |
| 95 | |
| 96 | Accounts are created in a browser only. There is no registration endpoint |
| 97 | for accounts. |
| 98 | |
| 99 | ## Requests and responses |
| 100 | |
| 101 | Request bodies are JSON. |
| 102 | |
| 103 | Every name in a body is `snake_case`, both ways: responses, errors, MCP |
| 104 | results and [webhook](/guides/webhooks/) payloads. Request bodies take the |
| 105 | same names as the MCP tools, and also accept the `camelCase` spelling: |
| 106 | |
| 107 | ```sh |
| 108 | # Both turn off counting agents' approvals. |
| 109 | curl -X PATCH https://api.g1t.sh/repos/flagon-io/hello/settings \ |
| 110 | -H "Authorization: Bearer $G1T_TOKEN" -d '{"count_agent_approvals": false}' |
| 111 | curl -X PATCH https://api.g1t.sh/repos/flagon-io/hello/settings \ |
| 112 | -H "Authorization: Bearer $G1T_TOKEN" -d '{"countAgentApprovals": false}' |
| 113 | ``` |
| 114 | |
| 115 | When a body gives a field both ways, the `snake_case` one is used. |
| 116 | |
| 117 | Names you chose are never changed: a workflow's `inputs`, the names of |
| 118 | secrets and variables, an environment's `env`, a job's `outputs` and |
| 119 | `matrix`, labels and headers come back exactly as they were written. |
| 120 | |
| 121 | Every person in a response, such as an issue's `author`, a workspace's |
| 122 | members or whoever `whoami` is, has two usernames: |
| 123 | |
| 124 | - `username` is lowercased. It is what an account is found, linked and |
| 125 | mentioned by, and it never changes case, so match on it. |
| 126 | - `display_username` is the username as its owner wrote it, such as |
| 127 | `Ana`. It is the same as `username` when they chose no case. Show it. |
| 128 | |
| 129 | ```json |
| 130 | { "id": "usr_01kkntcg1eeb98j62xjm7eh09p", "username": "ana", "display_username": "Ana" } |
| 131 | ``` |
| 132 | |
| 133 | Requests take a username in any case: `Ana` and `ana` are the same person. |
| 134 | |
| 135 | A successful request answers `200` with the result as the body: an object, |
| 136 | a list, or `true` for a deletion. There is no envelope around it. |
| 137 | |
| 138 | In paths, `{owner}` is the workspace that owns the repository and `{name}` |
| 139 | is the repository's name. Issues and pull requests are addressed by |
| 140 | `{number}`; the two share one sequence of numbers per repository, so a |
| 141 | number names exactly one of them. |
| 142 | |
| 143 | ## Errors |
| 144 | |
| 145 | Errors are JSON with a stable `code` and a human-readable `message`. |
| 146 | |
| 147 | ```json |
| 148 | { "error": { "code": "not_found", "message": "Repository not found." } } |
| 149 | ``` |
| 150 | |
| 151 | | Status | Code | Meaning | |
| 152 | | --- | --- | --- | |
| 153 | | 401 | `unauthenticated` | A token is required, or the one sent is not valid. | |
| 154 | | 402 | `payment_required` | The workspace cannot pay for this: to start an agent it needs the g1t plan or a card check, or it is at a limit; to make a repository private, or move a private one in, a free workspace needs room in its free private storage. Only endpoints that start an agent, change a repository's visibility or transfer it answer this. See [usage and billing](/guides/usage-and-billing/#when-work-is-stopped). | |
| 155 | | 403 | `forbidden` | You are signed in but not allowed to do this: your role is not enough, or the token lacks a scope, which `needed_scope` names. | |
| 156 | | 404 | `not_found` | It does not exist, or you cannot see it. A path that is not an endpoint answers this too. | |
| 157 | | 409 | `conflict` | The request conflicts with the current state. | |
| 158 | | 422 | `invalid` | The input is not valid. | |
| 159 | | 429 | `rate_limited` | Too many requests in the last minute. Wait the seconds `Retry-After` says. See [rate limits](#rate-limits). | |
| 160 | |
| 161 | Branch on `code`, not on `message`: messages are written for people and |
| 162 | may change. |
| 163 | |
| 164 | When an access token lacks the scope a call needs, the `403` also names |
| 165 | that scope in `needed_scope`: |
| 166 | |
| 167 | ```json |
| 168 | { |
| 169 | "error": { |
| 170 | "code": "forbidden", |
| 171 | "message": "This access token needs the issues:write scope to use create_issue.", |
| 172 | "needed_scope": "issues:write" |
| 173 | } |
| 174 | } |
| 175 | ``` |
| 176 | |
| 177 | Give the token that permission on its page under |
| 178 | [Settings → Access tokens](https://g1t.sh/settings/tokens), or use another |
| 179 | token. A `403` for any other reason has no `needed_scope`. |
| 180 | |
| 181 | ## Rate limits |
| 182 | |
| 183 | Each token may make 1,000 requests a minute. Requests without a token are |
| 184 | limited to 60 a minute for each IP address. Past either, the API answers |
| 185 | `429` with `rate_limited` and a `Retry-After` header saying how many |
| 186 | seconds to wait: |
| 187 | |
| 188 | ```json |
| 189 | { "error": { "code": "rate_limited", "message": "Too many requests with this token. Wait a minute and try again: https://docs.g1t.sh/reference/rate-limits/" } } |
| 190 | ``` |
| 191 | |
| 192 | Every limit, and how to stay under them, is on [rate limits](/reference/rate-limits/). |
| 193 | |
| 194 | ## Lists |
| 195 | |
| 196 | Lists come newest first, unless an endpoint says otherwise. Most return |
| 197 | everything up to a limit; the few that grow without bound take a cursor: |
| 198 | |
| 199 | | Endpoint | Limit | Next page | |
| 200 | | --- | --- | --- | |
| 201 | | [List repositories](/reference/api/repositories/list-repos/) | 50 | None | |
| 202 | | [List issues](/reference/api/issues/list-issues/) | 100 | None | |
| 203 | | [List pull requests](/reference/api/pull-requests/list-pull-requests/) | 100 | None | |
| 204 | | [List repository events](/reference/api/repositories/list-events/) | 50 | `before`: the id of the last event you have | |
| 205 | | [List workflow runs](/reference/api/actions/list-workflow-runs/) | `per_page`, at most 100 and 50 if not given | None | |
| 206 | | [List webhook deliveries](/reference/api/webhooks/list-webhook-deliveries/) | 50 | None | |
| 207 | | [List notifications](/reference/api/notifications/list-notifications/) | `per_page`, at most 100 and 30 if not given | `cursor`: the `next` of the page before | |
| 208 | | [Read a session](/reference/api/sessions/read-session/) | None | `after`: the last `seq` you have | |
| 209 | | [Get a job's log](/reference/api/actions/get-job-logs/) | 500 chunks | `after`: the last `seq` you have | |
| 210 | |
| 211 | ## Identifiers and times |
| 212 | |
| 213 | Issues and pull requests are addressed by repository and number. Other ids |
| 214 | are [TypeIDs](https://github.com/jetify-com/typeid): a prefix naming the |
| 215 | kind of thing, then a UUIDv7 in base32, for example |
| 216 | `pr_01jb2k7x9hfq0b3zj0f5s2m8ra`. They sort by creation time. |
| 217 | |
| 218 | Times are RFC 3339 in UTC, with milliseconds, such as |
| 219 | `2026-10-01T18:04:11.482Z`. |
| 220 | |
| 221 | ## Resources |
| 222 | |
| 223 | | Resource | | |
| 224 | | --- | --- | |
| 225 | | [Accounts](/reference/api/accounts/whoami/) | Signing in from a tool, and who a token acts as. Accounts are made and [deleted](/guides/authentication/#deleting-your-account) only in a browser: there is no route for either. | |
| 226 | | [Workspaces](/reference/api/workspaces/create-workspace/) | Creating a workspace. | |
| 227 | | [Notifications](/reference/api/notifications/list-notifications/) | Your notifications: their threads, why you were told of each, marking them read, done, saved or snoozed, and what you subscribe to and watch. See [notifications](/guides/notifications/). | |
| 228 | | [Billing](/reference/api/billing/get-usage/) | A workspace's usage by product, project and day, its budget, its AI credit, its invoices and its [AI Gateway](/guides/ai-gateway/) requests. See [usage and billing](/guides/usage-and-billing/). | |
| 229 | | [Invites](/reference/api/invites/list-invites/) | Your invites while g1t is invite-only, and inviting people into a workspace by email. | |
| 230 | | [Repositories](/reference/api/repositories/list-repos/) | A repository, how it handles pull requests, and its timeline. | |
| 231 | | [Access](/reference/api/access/list-collaborators/) | Who has which role on a repository, invitations, outside collaborators, and a workspace's base permission. | |
| 232 | | [Secret scanning](/reference/api/secret-scanning/list-secret-scanning-alerts/) | Secrets found in pushes and history, where each one is, bypassing push protection and reviewing bypass requests, validity checks, and custom patterns. See [secret protection](/guides/security/secret-protection/). | |
| 233 | | [Code scanning](/reference/api/code-scanning/list-code-scanning-alerts/) | SARIF uploads, the alerts and analyses they make, and fixing an alert with g1t. See [code scanning](/guides/security/code-scanning/). | |
| 234 | | [Supply chain](/reference/api/supply-chain/list-vulnerability-alerts/) | Vulnerability alerts, the dependency graph, its SPDX SBOM, and comparing dependencies. See [supply chain](/guides/security/supply-chain/). | |
| 235 | | [Security settings](/reference/api/security-settings/get-security-settings/) | When pull request checks fail, dependency review's policy, delegated bypass, validity checks and a workspace's overview. | |
| 236 | | [Issues](/reference/api/issues/list-issues/) | What should change, with labels and comments, and assigning it to g1t. | |
| 237 | | [Plans](/reference/api/plans/plan-work/) | An [outcome](/guides/outcomes/) turned into issues. | |
| 238 | | [Pull requests](/reference/api/pull-requests/list-pull-requests/) | Proposed changes: reviews, merging, the merge queue, and messages to the agent at work. | |
| 239 | | [Sessions](/reference/api/sessions/read-session/) | The record of how a pull request was made. | |
| 240 | | [Actions](/reference/api/actions/list-workflows/) | Workflows, their runs and their logs. | |
| 241 | | [Run protection](/reference/api/run-protection/update-environment/) | Environments' protection rules and the reviews of the jobs they hold, approving a pull request's run from outside, a job token's default permissions, and repository dispatch. See [GitHub Actions](/guides/actions/#environments). | |
| 242 | | [Secrets and variables](/reference/api/secrets-and-variables/list-actions-secrets/) | Values workflows and deployments read. | |
| 243 | | [Webhooks](/reference/api/webhooks/list-webhooks/) | Events sent to your own address. | |
| 244 | | [Integrations](/reference/api/integrations/list-integrations/) | Model providers, alert sources and issue trackers. | |
| 245 | | [Customize](/reference/api/customize/list-marketplaces/) | What shapes a workspace's agents, in the formats Claude Code reads: the marketplaces it reads plugins from, Discover, installed plugins, connectors with their keys and grants, and the bundle a run's Claude Code loads. See [Customize](/guides/customize/). | |