API reference
Repository contents
/ v1/ orgs/ :orgId/ git-credentialsThe caller's machine keys in the org (names, scopes, expiry; never secrets).
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).
Errors
403Sign in with the command line to create git credentials.
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/git-credentials' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
keys: {
keyId: string
orgId: string
name: string
kind: "api" | "mcp" | "agent"
scopes: string[]
createdBy: string
machineId?: string
expiresAt?: number
createdAt?: number
}[]
}/ v1/ orgs/ :orgId/ git-credentialsCreates a key with the caller's git scopes in the org (git:read, and git:write when they hold it) for one machine, replacing the machine's previous key. The key is returned once; it expires after 90 days. Needs a second factor confirmed in the last 10 minutes (403 code: "step_up": the CLI runs ID's step-up sign-in and asks again), and tells the org's owners (security.git_key).
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).
Request body
machineIdstringrequiredMatches
^[A-Za-z0-9_-]{16,64}$.machinestringrequired1–64 characters. Trimmed.
Errors
403Sign in with the command line to create git credentials.
curl -X POST 'https://api.cactive.com.au/v1/orgs/{orgId}/git-credentials' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"machineId": "<machineId>",
"machine": "example"
}'Response 201
{
key: string
keyId: string
name: string
scopes: ("platform:admin" | "platform:infra" | "platform:analytics" | "platform:coverage" | "org:read" | "org:write" | "audit:read" | "tenant:read" | "tenant:write" | "members:read" | "members:write" | "projects:read" | "projects:write" | "deployments:read" | "deployments:write" | "env:read" | "env:write" | "keys:read" | "keys:use" | "keys:write" | "domains:read" | "domains:write" | "resources:read" | "resources:write" | "git:read" | "git:write" | "git:admin" | "logs:read" | "analytics:read" | "knowledge:read" | "knowledge:write" | "connectors:read" | "connectors:write" | "chat:use" | "mcp:connect" | "agents:read" | "agents:write" | "agents:run" | "mail:read" | "mail:send" | "mail:admin" | "calendar:read" | "calendar:write" | "contacts:read" | "contacts:write" | "issues:read" | "issues:write" | "issues:admin" | "maps:read" | "maps:write" | "drive:read" | "drive:write" | "crm:read" | "crm:write" | "crm:admin" | "marketing:read" | "marketing:write" | "marketing:send" | "marketing:admin" | "health:read" | "health:write" | "weather:read" | "weather:write" | "food:read" | "food:write" | "vehicles:read" | "vehicles:write" | "vehicles:control" | "vehicles:admin" | "sharing:read" | "sharing:write")[]
expiresAt: number
}/ v1/ orgs/ :orgId/ git-credentials/ :keyIdRevokes one of the caller's machine keys.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).keyIdKey id (
key_…).
Errors
403Sign in with the command line to create git credentials.404Key not found
curl -X DELETE 'https://api.cactive.com.au/v1/orgs/{orgId}/git-credentials/{keyId}' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 204 with no body
/ v1/ orgs/ :orgId/ repos/ :name/ branchesBranches with their last commit.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Errors
404Repository not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/branches' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
defaultBranch: null | string
branches: {
name: string
commit: {
id: string
message: string
author: {
name?: string
email?: string
date?: number
}
committedAt: null | number
}
isDefault: boolean
protected: boolean
openPull: null | number
}[]
}/ v1/ orgs/ :orgId/ repos/ :name/ branches/ divergenceCommits ahead of / behind the default branch, per name (repeatable), bounded.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Errors
404Repository not found404Not found404Commit not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/branches/divergence' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
base: null | string
divergence: {}
}
| {
base: null | string
divergence: {
[key: string]: null | {
ahead: number
behind: number
exact: boolean
}
}
}/ v1/ orgs/ :orgId/ repos/ :name/ branchesCreates a branch from a branch, tag or commit.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
namestringrequired1–256 characters. Trimmed.
fromstringrequired1–256 characters.
Errors
400That commit doesn't exist.404Repository not found404Not found404Branch or tag not found409A branch with this name already exists.409A tag with this name already exists.
curl -X POST 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/branches' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"name": "Example",
"from": "example"
}'Response 201
{
branch: {
name: string
commitId: string
}
}/ v1/ orgs/ :orgId/ repos/ :name/ branchesDeletes the branch name. The default branch and branches whose rule blocks deletion can't be deleted.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
namestringrequired1–256 characters.
Errors
400The default branch can't be deleted.404Repository not found404Branch not found.
curl -X DELETE 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/branches?name=Example' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
deleted: string
commitId: null | string
}/ v1/ orgs/ :orgId/ repos/ :name/ contentsCommits file changes from the web: add or replace (base64 content), move or delete files, on branch or a newBranch. Fails if the branch moved since parentCommitId, 403 where a branch rule needs a pull request (unless you're on its bypass list), and 422 secret_detected with the findings when secret scanning finds something nobody allowed.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
uploadIdstringMatches
^[0-9a-f]{32}$.branchstringrequired1–256 characters.
parentCommitIdstringMatches
^[0-9a-f]{40}$.messagestringrequired1–1,000 characters. Trimmed.
descriptionstringUp to 20,000 characters.
newBranchstringUp to 256 characters. Trimmed.
changes(object | object | object | object)[]required1–1,000 items.
Errors
400…: …400… is changed more than once.400A file can't be moved onto itself.400uploadId is required for uploaded files.400parentCommitId is required.400Invalid upload id.400An uploaded file is missing. Upload the files again.404Repository not found404Branch … not found.409A branch named … already exists.409A tag named … already exists.413Web commits can change up to 1000 files and 50 MB of content. Push larger changes with git.
curl -X POST 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/contents' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"branch": "example",
"message": "example",
"changes": [
{}
]
}'Response 201
{
commitId?: string
branch: string
}Response 422
{
error: string
code: string
findings: {
line: number
fingerprint: string
preview: string
path?: string
rule: "aws_access_key" | "aws_secret_key" | "stripe_key" | "private_key" | "si_token" | "github_token"
label: string
}[]
}/ v1/ orgs/ :orgId/ repos/ :name/ contents/ uploadsPresigned upload URLs for a large web commit, one per file (sizes in bytes); the commit then names uploadId and each file's upload index. Uploads not committed are removed after a day.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
filesobject[]required1–1,000 items.
files[].sizeintegerrequired0–52428800.
Errors
404Repository not found413Web commits are limited to 50 MB. Push larger changes with git.
curl -X POST 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/contents/uploads' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"files": [
{
"size": 1
}
]
}'Response 201
{
uploadId: string
uploads: {
index: number
url: string
}[]
}/ v1/ orgs/ :orgId/ repos/ :name/ contents/ archiveZIP of a branch, tag or commit built in the background (for archives too large for the portal): pending until it exists, then a download link valid for 15 minutes.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
refstringrequired1–256 characters.
Errors
404Repository not found404Branch or tag not found
curl -X POST 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/contents/archive' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"ref": "example"
}'Response 200
{
status: "ready"
url: string
} | {
status: "pending"
} | {
status: "failed"
error: string
}/ v1/ orgs/ :orgId/ repos/ :name/ contents/ rawFile bytes; the portal's /raw route serves them with the right type. Files over 4 MB (a Lambda response's limit, base64) answer JSON with x-si-raw: large instead: a download link from the staging bucket (ready), pending while the archiver fetches it, or failed.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
refstringrequiredAt least 1 character.
pathstringrequiredAt least 1 character.
download"0" | "1"
Errors
404Repository not found404Not found404Branch or tag not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/contents/raw?ref=example&path=example' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
blobId: string
commitId: string
status: "ready"
url: string
} | {
blobId: string
commitId: string
status: "pending"
} | {
blobId: string
commitId: string
status: "failed"
error: string
}/ v1/ orgs/ :orgId/ repos/ :name/ contents/ filesEvery file path at a ref (for the file finder and archives), bounded.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
refstringrequiredAt least 1 character.
Errors
404Repository not found404Not found404Branch or tag not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/contents/files?ref=example' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
files: {
path: string
blobId: string
mode: string
type: "file" | "link"
}[]
truncated: boolean
commitId: string
}/ v1/ orgs/ :orgId/ repos/ :name/ contents/ blobsBlob contents (base64) in request order, as many as fit in one response; the caller asks again for the rest. Blobs too large for a response are marked tooLarge.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
idsstring[]required1–50 items. Each matches
^[0-9a-f]{40}$.
Errors
404Repository not found
curl -X POST 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/contents/blobs' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"ids": [
"example"
]
}'Response 200
{
blobs: {
id: string
content?: string
tooLarge?: true
}[]
}/ v1/ orgs/ :orgId/ repos/ :name/ compareCommits and changed files on head since it diverged from base, whether it merges cleanly, and any open pull request between them.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
basestringrequired1–256 characters.
headstringrequired1–256 characters.
Errors
400These branches are too far apart to compare.404Repository not found404Not found404Branch or tag not found404Branch or commit not found.404Commit not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/compare?base=example&head=example' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
mergeBase: string
status: string
aheadBy: number
behindBy: number
exact: true
commits: []
commitsTruncated: false
files: []
total: number
truncated: false
mergeOptions: []
conflicts: []
base: {
ref: string
commitId: string
}
head: {
ref: string
commitId: string
}
pull: null | number
}
| {
mergeOptions: ("fast-forward" | "squash" | "three-way")[]
conflicts: {
path: string
conflicts: number
binary: boolean
kind: "type" | "mode" | "content"
}[]
files: {
path: string
previousPath?: string
change: "added" | "deleted" | "modified" | "renamed"
similarity?: number
additions: number
deletions: number
binary?: boolean
collapsed?: boolean
hunks: {
oldStart: number
oldLines: number
newStart: number
newLines: number
lines: string[]
}[]
}[]
total: number
truncated: boolean
mergeBase: null | string
status: string
aheadBy: number
behindBy: number
exact: boolean
commits: {
id: string
message: string
author: {
name?: string
email?: string
date?: number
}
parents: string[]
committedAt?: number
}[]
commitsTruncated: boolean
base: {
ref: string
commitId: string
}
head: {
ref: string
commitId: string
}
pull: null | number
}/ v1/ orgs/ :orgId/ repos/ :name/ labelsThe repository's labels.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Errors
404Repository not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/labels' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
labels: {
name: string
color: string
description: string
}[]
}/ v1/ orgs/ :orgId/ repos/ :name/ labelsCreates or updates a label by name.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
namestringrequired1–50 characters. Trimmed.
color"chart-1" | "chart-2" | "chart-3" | "chart-4" | "chart-5" | "destructive" | "primary" | "muted-foreground"requireddescriptionstringUp to 100 characters. Trimmed.
Errors
400A repository can have up to 100 labels.404Repository not found
curl -X PUT 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/labels' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"name": "Example",
"color": "chart-1"
}'Response 200
{
label: {
name: string
color: string
description: string
}
}/ v1/ orgs/ :orgId/ repos/ :name/ labelsDeletes the label name and removes it from issues and pull requests.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
namestringrequired1–50 characters.
Errors
404Repository not found
curl -X DELETE 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/labels?name=Example' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 204 with no body
/ v1/ orgs/ :orgId/ repos/ -/ notificationsYour email settings for issues and pull requests in the organization: all off, and the repositories you muted. People only.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).
Errors
403Notification settings belong to people.
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/-/notifications' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
off: boolean
muted: {
repoId: string
name: string
}[]
}/ v1/ orgs/ :orgId/ repos/ -/ notificationsTurns your email about issues and pull requests in the organization off (off: true) or back on. Muted repositories stay muted.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).
Request body
offbooleanrequired
Errors
403Notification settings belong to people.
curl -X PUT 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/-/notifications' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"off": true
}'Response 200
{
off: boolean
muted: {
repoId: string
name: string
}[]
}/ v1/ orgs/ :orgId/ repos/ :name/ notificationsMutes (or unmutes) one repository for the person.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
mutedbooleanrequired
Errors
403Notification settings belong to people.404Repository not found
curl -X PUT 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/notifications' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"muted": true
}'Response 200
{
muted: boolean
off: boolean
}/ v1/ orgs/ :orgId/ reposThe organization's repositories with their default branch, language and last update.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
repos: {
name: string
resourceId: string
description: null | string
defaultBranch: null | string
createdAt?: number
updatedAt?: number
language?: null | string
access?: {
mode: "org" | "restricted"
level: "none" | "write" | "admin" | "read"
}
}[]
}/ v1/ orgs/ :orgId/ repos/ -/ availableWhether name can be used for a new repository, and why not.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).
Query parameters
namestringrequiredUp to 100 characters.
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/-/available?name=Example' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
name: string
available: boolean
reason: null | string
}/ v1/ orgs/ :orgId/ repos/ -/ peopleOrg members, for assignees and @mentions; with repo, only those who can read that repository.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).
Query parameters
repostringUp to 100 characters.
Errors
404Repository not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/-/people' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
people: {
userId: string
name: null | string
email: string
handle: string
}[]
}/ v1/ orgs/ :orgId/ reposCreates a repository, optionally with a first commit holding a README, a .gitignore template (Node, Next.js, Python, Go or Rust) and a license (MIT or Apache 2.0).
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:write
Path parameters
orgIdOrganization id (
org_…).
Request body
namestringrequiredMatches
^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$.descriptionstringUp to 1,000 characters. Trimmed.
readmebooleanDefault
false.gitignoreanylicenseanydefaultBranchstringDefault
"main". Trimmed.
Errors
400Unknown location: undefined409A repository with this name already exists.502Could not create the repository.502Could not create the initial commit.
curl -X POST 'https://api.cactive.com.au/v1/orgs/{orgId}/repos' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"name": "Example"
}'Response 201
{
repo: {
defaultBranch: string
empty: boolean
region: string
type: "repository" | "database" | "bucket"
name: string
status?: "error" | "active" | "deleting" | "creating"
createdAt?: number
updatedAt?: number
orgId: string
resourceId: string
createdBy: string
projectId?: string
location: string
arn?: string
physicalName: string
restoredFrom?: string
pendingSetup?: boolean
}
}/ v1/ orgs/ :orgId/ repos/ :name/ renameRenames a repository. Clone URLs change with it.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:write
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
namestringrequiredMatches
^[a-z0-9][a-z0-9-]{1,38}[a-z0-9]$.
Errors
404Repository not found409A repository with this name already exists.
curl -X POST 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/rename' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"name": "Example"
}'Response 200
{
name: string
}/ v1/ orgs/ :orgId/ repos/ :nameDeletes a repository with its history. confirm must be the repository name.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
confirmstringrequired
Errors
400Type the repository name to confirm.404Repository not found
curl -X DELETE 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}?confirm=example' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 204 with no body
/ v1/ orgs/ :orgId/ repos/ :name/ protectionThe default branch's protection: how many approvals pull requests into it need. The full rules are at branch-rules.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Errors
404Repository not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/protection' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
requiredApprovals: number
branch: null | string
}/ v1/ orgs/ :orgId/ repos/ :name/ protectionSets how many approvals (0–10) pull requests into the default branch need before they can be merged, as the default branch's rule (which also blocks force pushes and deletion; its bypass list stays). 0 lets direct pushes in again. Needs git:admin.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:admin
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
requiredApprovalsintegerrequired0–10.
Errors
400Push a branch before protecting it.404Repository not found
curl -X PUT 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/protection' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"requiredApprovals": 1
}'Response 200
{
requiredApprovals: number
branch: string
}/ v1/ orgs/ :orgId/ repos/ :name/ accessWho can reach the repository (docs/repo-access.md): its mode, the people, groups and machines on its list with names for them, and the last change. For those who can read the repository, and for owners (who manage the list without seeing the code).
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Errors
404Repository not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/access' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
access: {
mode: "org" | "restricted"
users: {
userId: string
level: "write" | "admin" | "read"
}[]
teams: {
teamId: string
level: "write" | "admin" | "read"
}[]
machines: {
id: "checks" | "pipelines" | string | "service:issues"
level: "write" | "read"
}[]
}
canManage: boolean
updatedAt: null | number
updatedBy: null | {
userId: string
name: null | string
email: string
}
labels: {
users: {
[key: string]: {
name?: string
email: string
}
}
teams: {
[key: string]: {
name: string
}
}
machines: {
[key: string]: {
label: string
detail?: string
}
}
}
}/ v1/ orgs/ :orgId/ repos/ :name/ accessChanges who can reach the repository: org owners only (a break-glass, audited), never through a key or an assistant.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
mode"org" | "restricted"requiredusersobject[]requiredUp to 100 items.
users[].userIdstringrequired1–64 characters.
users[].level"read" | "write" | "admin"requiredteamsobject[]requiredUp to 50 items.
teams[].teamIdstringrequired1–64 characters.
teams[].level"read" | "write" | "admin"requiredmachinesobject[]requiredUp to 50 items.
machines[].idstringrequired1–64 characters.
machines[].level"read" | "write"required
Errors
403Only owners of the organization can change who can access a repository.404Repository not found
curl -X PUT 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/access' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"mode": "org",
"users": [
{
"userId": "<userId>",
"level": "read"
}
],
"teams": [
{
"teamId": "<teamId>",
"level": "read"
}
],
"machines": [
{
"id": "<id>",
"level": "read"
}
]
}'Response 200
{
access: {
mode: "org" | "restricted"
users: {
userId: string
level: "write" | "admin" | "read"
}[]
teams: {
teamId: string
level: "write" | "admin" | "read"
}[]
machines: {
id: "checks" | "pipelines" | string | "service:issues"
level: "write" | "read"
}[]
}
canManage: boolean
updatedAt: null | number
updatedBy: null | {
userId: string
name: null | string
email: string
}
labels: {
users: {
[key: string]: {
name?: string
email: string
}
}
teams: {
[key: string]: {
name: string
}
}
machines: {
[key: string]: {
label: string
detail?: string
}
}
}
}/ v1/ orgs/ :orgId/ repos/ :name/ checksStarts checks of a branch in a sandbox: install, then the typecheck, lint, test and build scripts (or si.json checks). Nothing is deployed. Returns checkId (202). Needs git:write.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:write
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
branchstringrequired1–200 characters. Trimmed.
Errors
400Invalid branch name.404Repository not found
curl -X POST 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/checks' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"branch": "example"
}'Response 202
{
checkId: string
}/ v1/ orgs/ :orgId/ repos/ :name/ checks/ :checkIdA check run's status (queued, running, passed, failed, stopped, timed_out), steps and the end of its output (tail lines, default 80).
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
checkIdCheck run id, as returned when the checks started (
si-<stage>-checker:<uuid>).
Query parameters
tailintegerDefault
80. 0–500. Coerced from a string.
Errors
404Repository not found404Check run not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/checks/{checkId}' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
run: {
checkId: string
status: "queued" | "failed" | "stopped" | "running" | "timed_out" | "passed"
branch: string
startedAt?: number
endedAt?: number
steps: {
name: string
status: "skipped" | "failed" | "running" | "passed"
}[]
log: string[]
}
}/ v1/ orgs/ :orgId/ repos/ :name/ checks/ :checkIdStops a check run. Needs git:write.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:write
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
checkIdCheck run id, as returned when the checks started (
si-<stage>-checker:<uuid>).
Errors
404Repository not found404Check run not found
curl -X DELETE 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/checks/{checkId}' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 204 with no body
/ v1/ orgs/ :orgId/ repos/ :name/ branch-rulesThe branch rules in force (pull requests, approvals, code owners, force-push and deletion blocks, bypass list), whether they were saved or are the defaults, secret scanning (block or off), and the CODEOWNERS file found at the default branch with its errors.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Errors
404Repository not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/branch-rules' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
rules: {
branch: string
requirePullRequest: boolean
requiredApprovals: number
requireCodeOwners: boolean
blockForcePush: boolean
blockDeletion: boolean
bypass: string[]
}[]
explicit: boolean
secretScanning: "off" | "block"
defaultBranch: null | string
codeowners: {
path: null | string
rules: number
errors: {
line: number
message: string
}[]
}
}/ v1/ orgs/ :orgId/ repos/ :name/ branch-rulesReplaces the branch rules (up to 20; a name or a prefix ending in *) and optionally sets secret scanning. People on a bypass list must be able to write the repository. Open pull requests get the approval rules their target now asks for. Needs git:admin.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
rulesobject[]requiredUp to 20 items.
rules[].branchstringrequired1–256 characters.
rules[].requirePullRequestbooleanrequiredrules[].requiredApprovalsintegerrequired0–10.
rules[].requireCodeOwnersbooleanrequiredrules[].blockForcePushbooleanrequiredrules[].blockDeletionbooleanrequiredrules[].bypassstring[]Default
[]. Up to 20 items. Each up to 64 characters.secretScanning"block" | "off"
Errors
404Repository not found
curl -X PUT 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/branch-rules' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"rules": [
{
"branch": "example",
"requirePullRequest": true,
"requiredApprovals": 1,
"requireCodeOwners": true,
"blockForcePush": true,
"blockDeletion": true
}
]
}'Response 200
{
rules: {
branch: string
requirePullRequest: boolean
requiredApprovals: number
requireCodeOwners: boolean
blockForcePush: boolean
blockDeletion: boolean
bypass: string[]
}[]
explicit: true
secretScanning: "off" | "block"
defaultBranch: null | string
}/ v1/ orgs/ :orgId/ repos/ :name/ secret-scan/ allowancesSays findings a push or commit was refused for aren't secrets: their fingerprints (1–20) with a reason. Covers your pushes and web commits in this repository for an hour; audited. People only, with git:write.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
fingerprintsstring[]required1–20 items. Each matches
^[0-9a-f]{16}$.reasonstringrequired1–500 characters. Trimmed.
Errors
403Only people can allow a detected secret.404Repository not found
curl -X POST 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/secret-scan/allowances' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"fingerprints": [
"example"
],
"reason": "example"
}'Response 201
{
allowanceId: string
expiresAt: number
}/ v1/ orgs/ :orgId/ repos/ :name/ branches/ promoteFast-forwards a protected branch to the tip of from (for pushes too large for the git host to check), never forcing. Only where its rule lets you update it directly (you're on its bypass list, or it doesn't require pull requests), after a secret scan of the changes; audited.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
branchstringrequired1–256 characters.
fromstringrequired1–256 characters.
Errors
400Choose two different branches.404Repository not found404Branch … not found.409… isn't ahead of …: merge or rebase it first.409… changed. Try again.409The branches have diverged too far to promote.409… moved while the change was scanned. Promote again.
curl -X POST 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/branches/promote' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"branch": "example",
"from": "example"
}'/ v1/ orgs/ :orgId/ repos/ :name/ branches/ promote/ :promotionIdA promotion that's still scanning: moves it on, then answers as POST …/branches/promote does. Only for whoever began it.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
promotionIdA promotion (
prm_…), asPOST …/branches/promoteanswers it with 202.
Errors
404Repository not found404Promotion not found.409… moved while the change was scanned. Promote again.409… isn't ahead of …: merge or rebase it first.409… changed. Try again.409The branches have diverged too far to promote.
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/branches/promote/{promotionId}' \
-H "Authorization: Bearer $CACTIVE_TOKEN"/ v1/ orgs/ :orgId/ repos/ :name/ read-auditThe repository's read auditing (all, clones or off) and whether owners get clone alerts, defaults filled in.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Errors
404Repository not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/read-audit' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
readAudit: "off" | "all" | "clones"
cloneAlerts: boolean
}/ v1/ orgs/ :orgId/ repos/ :name/ read-auditChanges which reads are recorded (readAudit) and clone alerts (cloneAlerts); audited as repo.read_audit_update.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:admin
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
readAudit"all" | "clones" | "off"cloneAlertsboolean
Also checked: Unknown fields are rejected. Nothing to change.
Errors
404Repository not found
curl -X PUT 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/read-audit' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"readAudit": "all",
"cloneAlerts": true
}'Response 200
{
readAudit: "off" | "all" | "clones"
cloneAlerts: boolean
}/ v1/ orgs/ :orgId/ repos/ :nameRepository details: description, default branch, branches and open issue and pull request counts.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Errors
404Repository not found404Not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
resourceId: string
description: null | string
defaultBranch: null | string
branches: string[]
tags: string[]
initialBranch: null | string
protectedBranch: null | string
createdAt?: string
updatedAt?: string
openIssues: number
openPulls: number
scopes: ("platform:admin" | "platform:infra" | "platform:analytics" | "platform:coverage" | "org:read" | "org:write" | "audit:read" | "tenant:read" | "tenant:write" | "members:read" | "members:write" | "projects:read" | "projects:write" | "deployments:read" | "deployments:write" | "env:read" | "env:write" | "keys:read" | "keys:use" | "keys:write" | "domains:read" | "domains:write" | "resources:read" | "resources:write" | "git:read" | "git:write" | "git:admin" | "logs:read" | "analytics:read" | "knowledge:read" | "knowledge:write" | "connectors:read" | "connectors:write" | "chat:use" | "mcp:connect" | "agents:read" | "agents:write" | "agents:run" | "mail:read" | "mail:send" | "mail:admin" | "calendar:read" | "calendar:write" | "contacts:read" | "contacts:write" | "issues:read" | "issues:write" | "issues:admin" | "maps:read" | "maps:write" | "drive:read" | "drive:write" | "crm:read" | "crm:write" | "crm:admin" | "marketing:read" | "marketing:write" | "marketing:send" | "marketing:admin" | "health:read" | "health:write" | "weather:read" | "weather:write" | "food:read" | "food:write" | "vehicles:read" | "vehicles:write" | "vehicles:control" | "vehicles:admin" | "sharing:read" | "sharing:write")[]
access: {
mode: "org" | "restricted"
level: "none" | "write" | "admin" | "read"
}
notifications: null | {
off: boolean
muted: boolean
}
}/ v1/ orgs/ :orgId/ repos/ :nameUpdates the description or the default branch.
- Auth
- A person's token or an API key, as Authorization: Bearer.
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Request body
descriptionstringUp to 1,000 characters.
defaultBranchstring1–255 characters.
Errors
400Branch not found.404Repository not found
curl -X PATCH 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}' \
-H "Authorization: Bearer $CACTIVE_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"description": "example",
"defaultBranch": "example"
}'Response 200
{
ok: true
}/ v1/ orgs/ :orgId/ repos/ :name/ treeLists a directory at a branch or commit.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
refstringDefault
"main".pathstringDefault
"/".
Errors
404Repository not found404Not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/tree' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
commitId?: string
path: string
entries: {
type: "dir"
name: string
path: string
} | {
type: "file"
name: string
path: string
} | {
type: "link"
name: string
path: string
} | {
type: "submodule"
name: string
path: string
}[]
}/ v1/ orgs/ :orgId/ repos/ :name/ blobA file at a branch or commit. text is null for binary files and files over 1 MB. path is required.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
pathstringrefstringDefault
"main".
Errors
400path is required404Repository not found404Not found404Branch or tag not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/blob' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
path: string
size: null
commitId: string
blobId: string
mode?: "EXECUTABLE" | "NORMAL" | "SYMLINK"
text: null
}
| {
path: string
size: number
commitId?: string
blobId?: string
mode?: "EXECUTABLE" | "NORMAL" | "SYMLINK"
text: null | string
}/ v1/ orgs/ :orgId/ repos/ :name/ commitsFirst-parent history, newest first. With path, only commits that touch that file or folder (scanned reports how far the search went). Pass the returned next as cursor to continue.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
refstringDefault
"main". At least 1 character.cursorstringMatches
^[0-9a-f]{40}$.limitintegerDefault
20. 1–50. Coerced from a string.pathstring
Errors
404Repository not found404Not found404Branch or tag not found404Commit not found503The repository is busy. Try again in a moment.
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/commits' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
commits: {
id: string
message: string
author: {
name?: string
email?: string
date?: number
}
parents: string[]
committedAt?: number
}[]
next: null | string
scanned: number
}
| {
commits: {
id: string
message: string
author: {
name?: string
email?: string
date?: number
}
parents: string[]
committedAt?: number
}[]
next: null | string
}/ v1/ orgs/ :orgId/ repos/ :name/ last-commitsThe last commit that touched each entry of a folder. complete is false while more entries can be resolved by asking again (pending counts them, and their entries are null until then); once complete, null means older than the search reached. When the repository is busy the answer has head: null and nothing resolved; ask again.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
refstringDefault
"main". At least 1 character.pathstringDefault
"".
Errors
404Repository not found404Not found404Branch or tag not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/last-commits' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
head: string
latest: null | {
id: string
message: string
author: {
name?: string
date?: number
}
}
entries: {
[key: string]: null | {
id: string
message: string
author: {
name?: string
date?: number
}
}
}
complete: boolean
pending: number
scanned: number
path: string
} | {
pending: number
entries: {
[key: string]: null | {
id: string
message: string
author: {
name?: string
date?: number
}
}
}
latest: null | {
id: string
message: string
author: {
name?: string
date?: number
}
}
scanned: number
complete: boolean
head: null
path: string
}/ v1/ orgs/ :orgId/ repos/ :name/ last-commitThe last commit that touched a file. complete is false while it can still be found by asking again; head: null means the repository was busy.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
refstringDefault
"main". At least 1 character.pathstringrequiredAt least 1 character.
Errors
404Repository not found404Not found404Branch or tag not found404File not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/last-commit?path=example' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
head: string
commit: null | {
id: string
message: string
author: {
name?: string
date?: number
}
}
complete: boolean
scanned: number
path: string
} | {
head: null
commit: null
complete: boolean
scanned: number
path: string
}/ v1/ orgs/ :orgId/ repos/ :name/ commits/ :shaA commit and its changes against its first parent.
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
shaFull commit id or branch name.
Errors
404Repository not found404Not found404Commit not found404Branch or tag not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/commits/{sha}' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
files: {
path: string
previousPath?: string
change: "added" | "deleted" | "modified" | "renamed"
similarity?: number
additions: number
deletions: number
binary?: boolean
collapsed?: boolean
hunks: {
oldStart: number
oldLines: number
newStart: number
newLines: number
lines: string[]
}[]
}[]
total: number
truncated: boolean
commit: {
id: string
message: string
author: {
name?: string
email?: string
date?: number
}
parents: string[]
committedAt?: number
}
}/ v1/ orgs/ :orgId/ repos/ :name/ insightsContributors, weekly commit activity and languages for a branch (the default branch when ref is omitted).
- Auth
- A person's token or an API key, as Authorization: Bearer.
- Scope
- git:read
Path parameters
orgIdOrganization id (
org_…).nameRepository name.
Query parameters
refstring
Errors
404Repository not found404Not found404Branch or tag not found404Commit not found
curl 'https://api.cactive.com.au/v1/orgs/{orgId}/repos/{name}/insights' \
-H "Authorization: Bearer $CACTIVE_TOKEN"Response 200
{
ref: string
head: string
commitsAnalyzed: number
historyComplete: boolean
since: null | number
contributors: {
name: string
email?: string
commits: number
lastAt?: number
}[]
weeks: {
week: number
commits: number
}[]
languages: {
language: string
files: number
share: number
}[]
languagesComplete: boolean
}