API reference

Repository contents

A repository's settings, files, commits, diffs and insights.

The routes behind the Git portal. To clone and push, use Git over HTTPS.

`GET /v1/orgs/:orgId/git-credentials`

The caller's machine keys in the org (names, scopes, expiry; never secrets).

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).

Response 200

{
  keys: {
    keyId: string
    orgId: string
    name: string
    kind: "api" | "mcp" | "agent"
    scopes: string[]
    createdBy: string
    machineId?: string
    expiresAt?: number
    createdAt?: number
  }[]
}

Errors

Status	Message
`403`	Sign in with the command line to create git credentials.

`POST /v1/orgs/:orgId/git-credentials`

Creates a key with the caller's git scopes in the org (git:read, and git:write when they hold it) for one machine, replacing the machine's previous key. The key is returned once; it expires after 90 days. Needs a second factor confirmed in the last 10 minutes (403 code: "step_up": the CLI runs ID's step-up sign-in and asks again), and tells the org's owners (security.git_key).

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).

Request body

Field	Type	Required	Notes
`machineId`	`string`	Yes	matches `^[A-Za-z0-9_-]{16,64}$`
`machine`	`string`	Yes	1–64 characters; trimmed

Response 201

{
  key: string
  keyId: string
  name: string
  scopes: ("platform:admin" | "platform:infra" | "platform:analytics" | "platform:coverage" | "org:read" | "org:write" | "audit:read" | "tenant:read" | "tenant:write" | "members:read" | "members:write" | "projects:read" | "projects:write" | "deployments:read" | "deployments:write" | "env:read" | "env:write" | "keys:read" | "keys:use" | "keys:write" | "domains:read" | "domains:write" | "resources:read" | "resources:write" | "git:read" | "git:write" | "git:admin" | "logs:read" | "analytics:read" | "knowledge:read" | "knowledge:write" | "connectors:read" | "connectors:write" | "chat:use" | "mcp:connect" | "agents:read" | "agents:write" | "agents:run" | "mail:read" | "mail:send" | "mail:admin" | "calendar:read" | "calendar:write" | "contacts:read" | "contacts:write" | "issues:read" | "issues:write" | "issues:admin" | "maps:read" | "maps:write" | "drive:read" | "drive:write" | "crm:read" | "crm:write" | "crm:admin" | "marketing:read" | "marketing:write" | "marketing:send" | "marketing:admin" | "health:read" | "health:write" | "weather:read" | "weather:write" | "food:read" | "food:write")[]
  expiresAt: number
}

Errors

Status	Message
`403`	Sign in with the command line to create git credentials.

`DELETE /v1/orgs/:orgId/git-credentials/:keyId`

Revokes one of the caller's machine keys.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:keyId`	Key id (`key_…`).

Response 204 with no body.

Errors

Status	Message
`403`	Sign in with the command line to create git credentials.
`404`	Key not found

`GET /v1/orgs/:orgId/repos/:name/branches`

Branches with their last commit.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Response 200

{
  defaultBranch: null | string
  branches: {
    name: string
    commit: {
      id: string
      message: string
      author: {
        name?: string
        email?: string
        date?: number
      }
      committedAt: null | number
    }
    isDefault: boolean
    protected: boolean
    openPull: null | number
  }[]
}

Errors

Status	Message
`404`	Repository not found

`GET /v1/orgs/:orgId/repos/:name/branches/divergence`

Commits ahead of / behind the default branch, per name (repeatable), bounded.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Response 200

{
  base: null | string
  divergence: {}
}
| {
  base: null | string
  divergence: {
    [key: string]: null | {
      ahead: number
      behind: number
      exact: boolean
    }
  }
}

Errors

Status	Message
`404`	Repository not found
`404`	Not found
`404`	Commit not found

`POST /v1/orgs/:orgId/repos/:name/branches`

Creates a branch from a branch, tag or commit.

Auth: user access token or platform agent key · Scopes: git:read, git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`name`	`string`	Yes	1–256 characters; trimmed
`from`	`string`	Yes	1–256 characters

Response 201

{
  branch: {
    name: string
    commitId: string
  }
}

Errors

Status	Message
`400`	That commit doesn't exist.
`404`	Repository not found
`404`	Not found
`404`	Branch or tag not found
`409`	A branch with this name already exists.
`409`	A tag with this name already exists.

`DELETE /v1/orgs/:orgId/repos/:name/branches`

Deletes the branch name. The default branch and branches whose rule blocks deletion can't be deleted.

Auth: user access token or platform agent key · Scopes: git:read, git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Notes
`name`	`string`	Yes	1–256 characters

Response 200

{
  deleted: string
  commitId: null | string
}

Errors

Status	Message
`400`	The default branch can't be deleted.
`404`	Repository not found
`404`	Branch not found.

`GET /v1/orgs/:orgId/repos/:name/tags`

Tags and their commits. Create tags by pushing them with git.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Response 200

{
  tags: {
    name: string
    annotated: boolean
    object: string
    commit: {
      id: string
      message: string
      author: {
        name?: string
        email?: string
        date?: number
      }
      committedAt: null | number
    }
  }[]
}

Errors

Status	Message
`404`	Repository not found

`POST /v1/orgs/:orgId/repos/:name/contents`

Commits file changes from the web: add or replace (base64 content), move or delete files, on branch or a newBranch. Fails if the branch moved since parentCommitId, 403 where a branch rule needs a pull request (unless you're on its bypass list), and 422 secret_detected with the findings when secret scanning finds something nobody allowed.

Auth: user access token or platform agent key · Scopes: git:read, git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`uploadId`	`string`	No	matches `^[0-9a-f]{32}$`
`branch`	`string`	Yes	1–256 characters
`parentCommitId`	`string`	No	matches `^[0-9a-f]{40}$`
`message`	`string`	Yes	1–1,000 characters; trimmed
`description`	`string`	No	up to 20,000 characters
`newBranch`	`string`	No	up to 256 characters; trimmed
`changes`	`(object \| object \| object \| object)[]`	Yes	1–1,000 items

Response 201

{
  commitId?: string
  branch: string
}

Response 422

{
  error: string
  code: string
  findings: {
    line: number
    fingerprint: string
    preview: string
    path?: string
    rule: "aws_access_key" | "aws_secret_key" | "stripe_key" | "private_key" | "si_token" | "github_token"
    label: string
  }[]
}

Errors

Status	Message
`400`	…: …
`400`	… is changed more than once.
`400`	A file can't be moved onto itself.
`400`	uploadId is required for uploaded files.
`400`	parentCommitId is required.
`400`	Invalid upload id.
`400`	An uploaded file is missing. Upload the files again.
`404`	Repository not found
`404`	Branch … not found.
`409`	A branch named … already exists.
`409`	A tag named … already exists.
`413`	Web commits can change up to 1000 files and 50 MB of content. Push larger changes with git.

`POST /v1/orgs/:orgId/repos/:name/contents/uploads`

Presigned upload URLs for a large web commit, one per file (sizes in bytes); the commit then names uploadId and each file's upload index. Uploads not committed are removed after a day.

Auth: user access token or platform agent key · Scopes: git:read, git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`files`	`object[]`	Yes	1–1,000 items
`files[].size`	`integer`	Yes	0–52428800

Response 201

{
  uploadId: string
  uploads: {
    index: number
    url: string
  }[]
}

Errors

Status	Message
`404`	Repository not found
`413`	Web commits are limited to 50 MB. Push larger changes with git.

`POST /v1/orgs/:orgId/repos/:name/contents/archive`

ZIP of a branch, tag or commit built in the background (for archives too large for the portal): pending until it exists, then a download link valid for 15 minutes.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`ref`	`string`	Yes	1–256 characters

Response 200

{
  status: "ready"
  url: string
} | {
  status: "pending"
} | {
  status: "failed"
  error: string
}

Errors

Status	Message
`404`	Repository not found
`404`	Branch or tag not found

`GET /v1/orgs/:orgId/repos/:name/contents/raw`

File bytes; the portal's /raw route serves them with the right type. Files over 4 MB (a Lambda response's limit, base64) answer JSON with x-si-raw: large instead: a download link from the staging bucket (ready), pending while the archiver fetches it, or failed.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Notes
`ref`	`string`	Yes	at least 1 character
`path`	`string`	Yes	at least 1 character
`download`	`"0" \| "1"`	No

Response 200

{
  blobId: string
  commitId: string
  status: "ready"
  url: string
} | {
  blobId: string
  commitId: string
  status: "pending"
} | {
  blobId: string
  commitId: string
  status: "failed"
  error: string
}

Errors

Status	Message
`404`	Repository not found
`404`	Not found
`404`	Branch or tag not found

`GET /v1/orgs/:orgId/repos/:name/contents/files`

Every file path at a ref (for the file finder and archives), bounded.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Notes
`ref`	`string`	Yes	at least 1 character

Response 200

{
  files: {
    path: string
    blobId: string
    mode: string
    type: "file" | "link"
  }[]
  truncated: boolean
  commitId: string
}

Errors

Status	Message
`404`	Repository not found
`404`	Not found
`404`	Branch or tag not found

`POST /v1/orgs/:orgId/repos/:name/contents/blobs`

Blob contents (base64) in request order, as many as fit in one response; the caller asks again for the rest. Blobs too large for a response are marked tooLarge.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`ids`	`string[]`	Yes	1–50 items; each matches `^[0-9a-f]{40}$`

Response 200

{
  blobs: {
    id: string
    content?: string
    tooLarge?: true
  }[]
}

Errors

Status	Message
`404`	Repository not found

`GET /v1/orgs/:orgId/repos/:name/compare`

Commits and changed files on head since it diverged from base, whether it merges cleanly, and any open pull request between them.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Notes
`base`	`string`	Yes	1–256 characters
`head`	`string`	Yes	1–256 characters

Response 200

{
  mergeBase: string
  status: string
  aheadBy: number
  behindBy: number
  exact: true
  commits: []
  commitsTruncated: false
  files: []
  total: number
  truncated: false
  mergeOptions: []
  conflicts: []
  base: {
    ref: string
    commitId: string
  }
  head: {
    ref: string
    commitId: string
  }
  pull: null | number
}
| {
  mergeOptions: ("fast-forward" | "squash" | "three-way")[]
  conflicts: {
    path: string
    conflicts: number
    binary: boolean
    kind: "type" | "mode" | "content"
  }[]
  files: {
    path: string
    previousPath?: string
    change: "added" | "deleted" | "modified" | "renamed"
    similarity?: number
    additions: number
    deletions: number
    binary?: boolean
    collapsed?: boolean
    hunks: {
      oldStart: number
      oldLines: number
      newStart: number
      newLines: number
      lines: string[]
    }[]
  }[]
  total: number
  truncated: boolean
  mergeBase: null | string
  status: string
  aheadBy: number
  behindBy: number
  exact: boolean
  commits: {
    id: string
    message: string
    author: {
      name?: string
      email?: string
      date?: number
    }
    parents: string[]
    committedAt?: number
  }[]
  commitsTruncated: boolean
  base: {
    ref: string
    commitId: string
  }
  head: {
    ref: string
    commitId: string
  }
  pull: null | number
}

Errors

Status	Message
`400`	These branches are too far apart to compare.
`404`	Repository not found
`404`	Not found
`404`	Branch or tag not found
`404`	Branch or commit not found.
`404`	Commit not found

`GET /v1/orgs/:orgId/repos/:name/labels`

The repository's labels.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Response 200

{
  labels: {
    name: string
    color: string
    description: string
  }[]
}

Errors

Status	Message
`404`	Repository not found

`PUT /v1/orgs/:orgId/repos/:name/labels`

Creates or updates a label by name.

Auth: user access token or platform agent key · Scopes: git:read, git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`name`	`string`	Yes	1–50 characters; trimmed
`color`	`"chart-1" \| "chart-2" \| "chart-3" \| "chart-4" \| "chart-5" \| "destructive" \| "primary" \| "muted-foreground"`	Yes
`description`	`string`	No	up to 100 characters; trimmed

Response 200

{
  label: {
    name: string
    color: string
    description: string
  }
}

Errors

Status	Message
`400`	A repository can have up to 100 labels.
`404`	Repository not found

`DELETE /v1/orgs/:orgId/repos/:name/labels`

Deletes the label name and removes it from issues and pull requests.

Auth: user access token or platform agent key · Scopes: git:read, git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Notes
`name`	`string`	Yes	1–50 characters

Response 204 with no body.

Errors

Status	Message
`404`	Repository not found

`GET /v1/orgs/:orgId/repos/-/notifications`

Your email settings for issues and pull requests in the organization: all off, and the repositories you muted. People only.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).

Response 200

{
  off: boolean
  muted: {
    repoId: string
    name: string
  }[]
}

Errors

Status	Message
`403`	Notification settings belong to people.

`PUT /v1/orgs/:orgId/repos/-/notifications`

Turns your email about issues and pull requests in the organization off (off: true) or back on. Muted repositories stay muted.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).

Request body

Field	Type	Required	Notes
`off`	`boolean`	Yes

Response 200

{
  off: boolean
  muted: {
    repoId: string
    name: string
  }[]
}

Errors

Status	Message
`403`	Notification settings belong to people.

`PUT /v1/orgs/:orgId/repos/:name/notifications`

Mutes (or unmutes) one repository for the person.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`muted`	`boolean`	Yes

Response 200

{
  muted: boolean
  off: boolean
}

Errors

Status	Message
`403`	Notification settings belong to people.
`404`	Repository not found

`GET /v1/orgs/:orgId/repos`

The organization's repositories with their default branch, language and last update.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).

Response 200

{
  repos: {
    name: string
    resourceId: string
    description: null | string
    defaultBranch: null | string
    createdAt?: number
    updatedAt?: number
    language?: null | string
    access?: {
      mode: "org" | "restricted"
      level: "none" | "write" | "admin" | "read"
    }
  }[]
}

`GET /v1/orgs/:orgId/repos/-/available`

Whether name can be used for a new repository, and why not.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).

Query parameter	Type	Required	Notes
`name`	`string`	Yes	up to 100 characters

Response 200

{
  name: string
  available: boolean
  reason: null | string
}

`GET /v1/orgs/:orgId/repos/-/people`

Org members, for assignees and @mentions; with repo, only those who can read that repository.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).

Query parameter	Type	Required	Notes
`repo`	`string`	No	up to 100 characters

Response 200

{
  people: {
    userId: string
    name: null | string
    email: string
    handle: string
  }[]
}

Errors

Status	Message
`404`	Repository not found

`POST /v1/orgs/:orgId/repos`

Creates a repository, optionally with a first commit holding a README, a .gitignore template (Node, Next.js, Python, Go or Rust) and a license (MIT or Apache 2.0).

Auth: user access token or platform agent key · Scope: git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).

Request body

Field	Type	Required	Default	Notes
`name`	`string`	Yes		matches `^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$`
`description`	`string`	No		up to 1,000 characters; trimmed
`readme`	`boolean`	No	`false`
`gitignore`	``	No
`license`	``	No
`defaultBranch`	`string`	No	`"main"`	trimmed

Response 201

{
  repo: {
    defaultBranch: string
    empty: boolean
    region: string
    type: "repository" | "database" | "bucket"
    name: string
    status?: "error" | "active" | "creating" | "deleting"
    createdAt?: number
    updatedAt?: number
    orgId: string
    resourceId: string
    createdBy: string
    projectId?: string
    location: string
    arn?: string
    physicalName: string
    restoredFrom?: string
    pendingSetup?: boolean
  }
}

Errors

Status	Message
`400`	Unknown location: undefined
`409`	A repository with this name already exists.
`502`	Could not create the repository.
`502`	Could not create the initial commit.

`POST /v1/orgs/:orgId/repos/:name/rename`

Renames a repository. Clone URLs change with it.

Auth: user access token or platform agent key · Scope: git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`name`	`string`	Yes	matches `^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$`

Response 200

{
  name: string
}

Errors

Status	Message
`404`	Repository not found
`409`	A repository with this name already exists.

`DELETE /v1/orgs/:orgId/repos/:name`

Deletes a repository with its history. confirm must be the repository name.

Auth: user access token or platform agent key · Scopes: git:write, git:admin (when c.get("repo")?.access.mode === "restricted")

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Notes
`confirm`	`string`	Yes

Response 204 with no body.

Errors

Status	Message
`400`	Type the repository name to confirm.
`404`	Repository not found

`GET /v1/orgs/:orgId/repos/:name/protection`

The default branch's protection: how many approvals pull requests into it need. The full rules are at branch-rules.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Response 200

{
  requiredApprovals: number
  branch: null | string
}

Errors

Status	Message
`404`	Repository not found

`PUT /v1/orgs/:orgId/repos/:name/protection`

Sets how many approvals (0–10) pull requests into the default branch need before they can be merged, as the default branch's rule (which also blocks force pushes and deletion; its bypass list stays). 0 lets direct pushes in again. Needs git:admin.

Auth: user access token or platform agent key · Scope: git:admin

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`requiredApprovals`	`integer`	Yes	0–10

Response 200

{
  requiredApprovals: number
  branch: string
}

Errors

Status	Message
`400`	Push a branch before protecting it.
`404`	Repository not found

`GET /v1/orgs/:orgId/repos/:name/access`

Who can reach the repository (docs/repo-access.md): its mode, the people, groups and machines on its list with names for them, and the last change. For those who can read the repository, and for owners (who manage the list without seeing the code).

Auth: user access token or platform agent key

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Response 200

{
  access: {
    mode: "org" | "restricted"
    users: {
      userId: string
      level: "write" | "admin" | "read"
    }[]
    teams: {
      teamId: string
      level: "write" | "admin" | "read"
    }[]
    machines: {
      id: "checks" | "pipelines" | string | "service:issues"
      level: "write" | "read"
    }[]
  }
  canManage: boolean
  updatedAt: null | number
  updatedBy: null | {
    userId: string
    name: null | string
    email: string
  }
  labels: {
    users: {
      [key: string]: {
        name?: string
        email: string
      }
    }
    teams: {
      [key: string]: {
        name: string
      }
    }
    machines: {
      [key: string]: {
        label: string
        detail?: string
      }
    }
  }
}

Errors

Status	Message
`404`	Repository not found

`PUT /v1/orgs/:orgId/repos/:name/access`

Changes who can reach the repository: org owners only (a break-glass, audited), never through a key or an assistant.

Auth: user access token or platform agent key

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`mode`	`"org" \| "restricted"`	Yes
`users`	`object[]`	Yes	up to 100 items
`users[].userId`	`string`	Yes	1–64 characters
`users[].level`	`"read" \| "write" \| "admin"`	Yes
`teams`	`object[]`	Yes	up to 50 items
`teams[].teamId`	`string`	Yes	1–64 characters
`teams[].level`	`"read" \| "write" \| "admin"`	Yes
`machines`	`object[]`	Yes	up to 50 items
`machines[].id`	`string`	Yes	1–64 characters
`machines[].level`	`"read" \| "write"`	Yes

Response 200

{
  access: {
    mode: "org" | "restricted"
    users: {
      userId: string
      level: "write" | "admin" | "read"
    }[]
    teams: {
      teamId: string
      level: "write" | "admin" | "read"
    }[]
    machines: {
      id: "checks" | "pipelines" | string | "service:issues"
      level: "write" | "read"
    }[]
  }
  canManage: boolean
  updatedAt: null | number
  updatedBy: null | {
    userId: string
    name: null | string
    email: string
  }
  labels: {
    users: {
      [key: string]: {
        name?: string
        email: string
      }
    }
    teams: {
      [key: string]: {
        name: string
      }
    }
    machines: {
      [key: string]: {
        label: string
        detail?: string
      }
    }
  }
}

Errors

Status	Message
`403`	Only owners of the organization can change who can access a repository.
`404`	Repository not found

`POST /v1/orgs/:orgId/repos/:name/checks`

Starts checks of a branch in a sandbox: install, then the typecheck, lint, test and build scripts (or si.json checks). Nothing is deployed. Returns checkId (202). Needs git:write.

Auth: user access token or platform agent key · Scope: git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`branch`	`string`	Yes	1–200 characters; trimmed

Response 202

{
  checkId: string
}

Errors

Status	Message
`400`	Invalid branch name.
`404`	Repository not found

`GET /v1/orgs/:orgId/repos/:name/checks/:checkId`

A check run's status (queued, running, passed, failed, stopped, timed_out), steps and the end of its output (tail lines, default 80).

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.
`:checkId`	Check run id, as returned when the checks started (`si-<stage>-checker:<uuid>`).

Query parameter	Type	Required	Default	Notes
`tail`	`integer`	No	`80`	0–500; coerced from a string

Response 200

{
  run: {
    checkId: string
    status: "queued" | "failed" | "timed_out" | "running" | "passed" | "stopped"
    branch: string
    startedAt?: number
    endedAt?: number
    steps: {
      name: string
      status: "skipped" | "failed" | "running" | "passed"
    }[]
    log: string[]
  }
}

Errors

Status	Message
`404`	Repository not found
`404`	Check run not found

`DELETE /v1/orgs/:orgId/repos/:name/checks/:checkId`

Stops a check run. Needs git:write.

Auth: user access token or platform agent key · Scope: git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.
`:checkId`	Check run id, as returned when the checks started (`si-<stage>-checker:<uuid>`).

Response 204 with no body.

Errors

Status	Message
`404`	Repository not found
`404`	Check run not found

`GET /v1/orgs/:orgId/repos/:name/branch-rules`

The branch rules in force (pull requests, approvals, code owners, force-push and deletion blocks, bypass list), whether they were saved or are the defaults, secret scanning (block or off), and the CODEOWNERS file found at the default branch with its errors.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Response 200

{
  rules: {
    branch: string
    requirePullRequest: boolean
    requiredApprovals: number
    requireCodeOwners: boolean
    blockForcePush: boolean
    blockDeletion: boolean
    bypass: string[]
  }[]
  explicit: boolean
  secretScanning: "off" | "block"
  defaultBranch: null | string
  codeowners: {
    path: null | string
    rules: number
    errors: {
      line: number
      message: string
    }[]
  }
}

Errors

Status	Message
`404`	Repository not found

`PUT /v1/orgs/:orgId/repos/:name/branch-rules`

Replaces the branch rules (up to 20; a name or a prefix ending in *) and optionally sets secret scanning. People on a bypass list must be able to write the repository. Open pull requests get the approval rules their target now asks for. Needs git:admin.

Auth: user access token or platform agent key · Scopes: git:read, git:admin

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Default	Notes
`rules`	`object[]`	Yes		up to 20 items
`rules[].branch`	`string`	Yes		1–256 characters
`rules[].requirePullRequest`	`boolean`	Yes
`rules[].requiredApprovals`	`integer`	Yes		0–10
`rules[].requireCodeOwners`	`boolean`	Yes
`rules[].blockForcePush`	`boolean`	Yes
`rules[].blockDeletion`	`boolean`	Yes
`rules[].bypass`	`string[]`	No	`[]`	up to 20 items; each up to 64 characters
`secretScanning`	`"block" \| "off"`	No

Response 200

{
  rules: {
    branch: string
    requirePullRequest: boolean
    requiredApprovals: number
    requireCodeOwners: boolean
    blockForcePush: boolean
    blockDeletion: boolean
    bypass: string[]
  }[]
  explicit: true
  secretScanning: "off" | "block"
  defaultBranch: null | string
}

Errors

Status	Message
`404`	Repository not found

`POST /v1/orgs/:orgId/repos/:name/secret-scan/allowances`

Says findings a push or commit was refused for aren't secrets: their fingerprints (1–20) with a reason. Covers your pushes and web commits in this repository for an hour; audited. People only, with git:write.

Auth: user access token or platform agent key · Scopes: git:read, git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`fingerprints`	`string[]`	Yes	1–20 items; each matches `^[0-9a-f]{16}$`
`reason`	`string`	Yes	1–500 characters; trimmed

Response 201

{
  allowanceId: string
  expiresAt: number
}

Errors

Status	Message
`403`	Only people can allow a detected secret.
`404`	Repository not found

`POST /v1/orgs/:orgId/repos/:name/branches/promote`

Fast-forwards a protected branch to the tip of from (for pushes too large for the git host to check), never forcing. Only where its rule lets you update it directly (you're on its bypass list, or it doesn't require pull requests), after a secret scan of the changes; audited.

Auth: user access token or platform agent key · Scopes: git:read, git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`branch`	`string`	Yes	1–256 characters
`from`	`string`	Yes	1–256 characters

Response 200

{
  commitId: string
}

Response 422

{
  error: string
  code: string
  findings: {
    line: number
    fingerprint: string
    preview: string
    path?: string
    rule: "aws_access_key" | "aws_secret_key" | "stripe_key" | "private_key" | "si_token" | "github_token"
    label: string
  }[]
}

Errors

Status	Message
`400`	Choose two different branches.
`404`	Repository not found
`404`	Branch … not found.
`409`	… isn't ahead of …: merge or rebase it first.
`409`	… changed. Try again.
`409`	The branches have diverged too far to promote.

`GET /v1/orgs/:orgId/repos/:name/read-audit`

The repository's read auditing (all, clones or off) and whether owners get clone alerts, defaults filled in.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Response 200

{
  readAudit: "off" | "all" | "clones"
  cloneAlerts: boolean
}

Errors

Status	Message
`404`	Repository not found

`PUT /v1/orgs/:orgId/repos/:name/read-audit`

Changes which reads are recorded (readAudit) and clone alerts (cloneAlerts); audited as repo.read_audit_update.

Auth: user access token or platform agent key · Scope: git:admin

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`readAudit`	`"all" \| "clones" \| "off"`	No
`cloneAlerts`	`boolean`	No

Also checked: Unknown fields are rejected. Nothing to change.

Response 200

{
  readAudit: "off" | "all" | "clones"
  cloneAlerts: boolean
}

Errors

Status	Message
`404`	Repository not found

`GET /v1/orgs/:orgId/repos/:name`

Repository details: description, default branch, branches and open issue and pull request counts.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Response 200

{
  resourceId: string
  description: null | string
  defaultBranch: null | string
  branches: string[]
  tags: string[]
  initialBranch: null | string
  protectedBranch: null | string
  createdAt?: string
  updatedAt?: string
  openIssues: number
  openPulls: number
  scopes: ("platform:admin" | "platform:infra" | "platform:analytics" | "platform:coverage" | "org:read" | "org:write" | "audit:read" | "tenant:read" | "tenant:write" | "members:read" | "members:write" | "projects:read" | "projects:write" | "deployments:read" | "deployments:write" | "env:read" | "env:write" | "keys:read" | "keys:use" | "keys:write" | "domains:read" | "domains:write" | "resources:read" | "resources:write" | "git:read" | "git:write" | "git:admin" | "logs:read" | "analytics:read" | "knowledge:read" | "knowledge:write" | "connectors:read" | "connectors:write" | "chat:use" | "mcp:connect" | "agents:read" | "agents:write" | "agents:run" | "mail:read" | "mail:send" | "mail:admin" | "calendar:read" | "calendar:write" | "contacts:read" | "contacts:write" | "issues:read" | "issues:write" | "issues:admin" | "maps:read" | "maps:write" | "drive:read" | "drive:write" | "crm:read" | "crm:write" | "crm:admin" | "marketing:read" | "marketing:write" | "marketing:send" | "marketing:admin" | "health:read" | "health:write" | "weather:read" | "weather:write" | "food:read" | "food:write")[]
  access: {
    mode: "org" | "restricted"
    level: "none" | "write" | "admin" | "read"
  }
  notifications: null | {
    off: boolean
    muted: boolean
  }
}

Errors

Status	Message
`404`	Repository not found
`404`	Not found

`PATCH /v1/orgs/:orgId/repos/:name`

Updates the description or the default branch.

Auth: user access token or platform agent key · Scopes: git:read, git:write

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Request body

Field	Type	Required	Notes
`description`	`string`	No	up to 1,000 characters
`defaultBranch`	`string`	No	1–255 characters

Response 200

{
  ok: true
}

Errors

Status	Message
`400`	Branch not found.
`404`	Repository not found

`GET /v1/orgs/:orgId/repos/:name/tree`

Lists a directory at a branch or commit.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Default	Notes
`ref`	`string`	No	`"main"`
`path`	`string`	No	`"/"`

Response 200

{
  commitId?: string
  path: string
  entries: {
    type: "dir"
    name: string
    path: string
  } | {
    type: "file"
    name: string
    path: string
  } | {
    type: "link"
    name: string
    path: string
  } | {
    type: "submodule"
    name: string
    path: string
  }[]
}

Errors

Status	Message
`404`	Repository not found
`404`	Not found

`GET /v1/orgs/:orgId/repos/:name/blob`

A file at a branch or commit. text is null for binary files and files over 1 MB. path is required.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Default	Notes
`path`	`string`	No
`ref`	`string`	No	`"main"`

Response 200

{
  path: string
  size: null
  commitId: string
  blobId: string
  mode?: "EXECUTABLE" | "NORMAL" | "SYMLINK"
  text: null
}
| {
  path: string
  size: number
  commitId?: string
  blobId?: string
  mode?: "EXECUTABLE" | "NORMAL" | "SYMLINK"
  text: null | string
}

Errors

Status	Message
`400`	path is required
`404`	Repository not found
`404`	Not found
`404`	Branch or tag not found

`GET /v1/orgs/:orgId/repos/:name/commits`

First-parent history, newest first. With path, only commits that touch that file or folder (scanned reports how far the search went). Pass the returned next as cursor to continue.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Default	Notes
`ref`	`string`	No	`"main"`	at least 1 character
`cursor`	`string`	No		matches `^[0-9a-f]{40}$`
`limit`	`integer`	No	`20`	1–50; coerced from a string
`path`	`string`	No

Response 200

{
  commits: {
    id: string
    message: string
    author: {
      name?: string
      email?: string
      date?: number
    }
    parents: string[]
    committedAt?: number
  }[]
  next: null | string
  scanned: number
}
| {
  commits: {
    id: string
    message: string
    author: {
      name?: string
      email?: string
      date?: number
    }
    parents: string[]
    committedAt?: number
  }[]
  next: null | string
}

Errors

Status	Message
`404`	Repository not found
`404`	Not found
`404`	Branch or tag not found
`404`	Commit not found
`503`	The repository is busy. Try again in a moment.

`GET /v1/orgs/:orgId/repos/:name/last-commits`

The last commit that touched each entry of a folder. complete is false while more entries can be resolved by asking again (pending counts them, and their entries are null until then); once complete, null means older than the search reached. When the repository is busy the answer has head: null and nothing resolved; ask again.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Default	Notes
`ref`	`string`	No	`"main"`	at least 1 character
`path`	`string`	No	`""`

Response 200

{
  head: string
  latest: null | {
    id: string
    message: string
    author: {
      name?: string
      date?: number
    }
  }
  entries: {
    [key: string]: null | {
      id: string
      message: string
      author: {
        name?: string
        date?: number
      }
    }
  }
  complete: boolean
  pending: number
  scanned: number
  path: string
} | {
  pending: number
  entries: {
    [key: string]: null | {
      id: string
      message: string
      author: {
        name?: string
        date?: number
      }
    }
  }
  complete: boolean
  latest: null | {
    id: string
    message: string
    author: {
      name?: string
      date?: number
    }
  }
  scanned: number
  head: null
  path: string
}

Errors

Status	Message
`404`	Repository not found
`404`	Not found
`404`	Branch or tag not found

`GET /v1/orgs/:orgId/repos/:name/last-commit`

The last commit that touched a file. complete is false while it can still be found by asking again; head: null means the repository was busy.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Default	Notes
`ref`	`string`	No	`"main"`	at least 1 character
`path`	`string`	Yes		at least 1 character

Response 200

{
  head: string
  commit: null | {
    id: string
    message: string
    author: {
      name?: string
      date?: number
    }
  }
  complete: boolean
  scanned: number
  path: string
} | {
  head: null
  commit: null
  complete: boolean
  scanned: number
  path: string
}

Errors

Status	Message
`404`	Repository not found
`404`	Not found
`404`	Branch or tag not found
`404`	File not found

`GET /v1/orgs/:orgId/repos/:name/commits/:sha`

A commit and its changes against its first parent.

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.
`:sha`	Full commit id or branch name.

Response 200

{
  files: {
    path: string
    previousPath?: string
    change: "added" | "deleted" | "modified" | "renamed"
    similarity?: number
    additions: number
    deletions: number
    binary?: boolean
    collapsed?: boolean
    hunks: {
      oldStart: number
      oldLines: number
      newStart: number
      newLines: number
      lines: string[]
    }[]
  }[]
  total: number
  truncated: boolean
  commit: {
    id: string
    message: string
    author: {
      name?: string
      email?: string
      date?: number
    }
    parents: string[]
    committedAt?: number
  }
}

Errors

Status	Message
`404`	Repository not found
`404`	Not found
`404`	Commit not found
`404`	Branch or tag not found

`GET /v1/orgs/:orgId/repos/:name/insights`

Contributors, weekly commit activity and languages for a branch (the default branch when ref is omitted).

Auth: user access token or platform agent key · Scope: git:read

Path parameter	Description
`:orgId`	Organization id (`org_…`).
`:name`	Repository name.

Query parameter	Type	Required	Notes
`ref`	`string`	No

Response 200

{
  ref: string
  head: string
  commitsAnalyzed: number
  historyComplete: boolean
  since: null | number
  contributors: {
    name: string
    email?: string
    commits: number
    lastAt?: number
  }[]
  weeks: {
    week: number
    commits: number
  }[]
  languages: {
    language: string
    files: number
    share: number
  }[]
  languagesComplete: boolean
}

Errors

Status	Message
`404`	Repository not found
`404`	Not found
`404`	Branch or tag not found
`404`	Commit not found

Repository contents

On this page