API

Repository contents

A repository's settings, files, commits, diffs and insights.

The routes behind the Git portal. To clone and push, use Git over HTTPS.

Every route below, with its parameters, request and response, errors and samples, is in the API reference.

Route	What it does
`GET /v1/orgs/:orgId/git-credentials`	The caller's machine keys in the org (names, scopes, expiry; never secrets).
`POST /v1/orgs/:orgId/git-credentials`	Creates a key with the caller's git scopes in the org (`git:read`, and `git:write` when they hold it) for one machine, replacing the machine's previous key. The key is returned once; it expires after 90 days. Needs a second factor confirmed in the last 10 minutes (403 `code: "step_up"`: the CLI runs ID's step-up sign-in and asks again), and tells the org's owners (`security.git_key`).
`DELETE /v1/orgs/:orgId/git-credentials/:keyId`	Revokes one of the caller's machine keys.
`GET /v1/orgs/:orgId/repos/:name/branches`	Branches with their last commit.
`GET /v1/orgs/:orgId/repos/:name/branches/divergence`	Commits ahead of / behind the default branch, per `name` (repeatable), bounded.
`POST /v1/orgs/:orgId/repos/:name/branches`	Creates a branch from a branch, tag or commit.
`DELETE /v1/orgs/:orgId/repos/:name/branches`	Deletes the branch `name`. The default branch and branches whose rule blocks deletion can't be deleted.
`GET /v1/orgs/:orgId/repos/:name/tags`	Tags and their commits. Create tags by pushing them with git.
`POST /v1/orgs/:orgId/repos/:name/contents`	Commits file changes from the web: add or replace (base64 content), move or delete files, on `branch` or a `newBranch`. Fails if the branch moved since `parentCommitId`, 403 where a branch rule needs a pull request (unless you're on its bypass list), and 422 `secret_detected` with the `findings` when secret scanning finds something nobody allowed.
`POST /v1/orgs/:orgId/repos/:name/contents/uploads`	Presigned upload URLs for a large web commit, one per file (sizes in bytes); the commit then names `uploadId` and each file's `upload` index. Uploads not committed are removed after a day.
`POST /v1/orgs/:orgId/repos/:name/contents/archive`	ZIP of a branch, tag or commit built in the background (for archives too large for the portal): `pending` until it exists, then a download link valid for 15 minutes.
`GET /v1/orgs/:orgId/repos/:name/contents/raw`	File bytes; the portal's /raw route serves them with the right type. Files over 4 MB (a Lambda response's limit, base64) answer JSON with `x-si-raw: large` instead: a download link from the staging bucket (`ready`), `pending` while the archiver fetches it, or `failed`.
`GET /v1/orgs/:orgId/repos/:name/contents/files`	Every file path at a ref (for the file finder and archives), bounded.
`POST /v1/orgs/:orgId/repos/:name/contents/blobs`	Blob contents (base64) in request order, as many as fit in one response; the caller asks again for the rest. Blobs too large for a response are marked `tooLarge`.
`GET /v1/orgs/:orgId/repos/:name/compare`	Commits and changed files on `head` since it diverged from `base`, whether it merges cleanly, and any open pull request between them.
`GET /v1/orgs/:orgId/repos/:name/labels`	The repository's labels.
`PUT /v1/orgs/:orgId/repos/:name/labels`	Creates or updates a label by name.
`DELETE /v1/orgs/:orgId/repos/:name/labels`	Deletes the label `name` and removes it from issues and pull requests.
`GET /v1/orgs/:orgId/repos/-/notifications`	Your email settings for issues and pull requests in the organization: all off, and the repositories you muted. People only.
`PUT /v1/orgs/:orgId/repos/-/notifications`	Turns your email about issues and pull requests in the organization off (`off: true`) or back on. Muted repositories stay muted.
`PUT /v1/orgs/:orgId/repos/:name/notifications`	Mutes (or unmutes) one repository for the person.
`GET /v1/orgs/:orgId/repos`	The organization's repositories with their default branch, language and last update.
`GET /v1/orgs/:orgId/repos/-/available`	Whether `name` can be used for a new repository, and why not.
`GET /v1/orgs/:orgId/repos/-/people`	Org members, for assignees and @mentions; with `repo`, only those who can read that repository.
`POST /v1/orgs/:orgId/repos`	Creates a repository, optionally with a first commit holding a README, a `.gitignore` template (Node, Next.js, Python, Go or Rust) and a license (MIT or Apache 2.0).
`POST /v1/orgs/:orgId/repos/:name/rename`	Renames a repository. Clone URLs change with it.
`DELETE /v1/orgs/:orgId/repos/:name`	Deletes a repository with its history. `confirm` must be the repository name.
`GET /v1/orgs/:orgId/repos/:name/protection`	The default branch's protection: how many approvals pull requests into it need. The full rules are at `branch-rules`.
`PUT /v1/orgs/:orgId/repos/:name/protection`	Sets how many approvals (0–10) pull requests into the default branch need before they can be merged, as the default branch's rule (which also blocks force pushes and deletion; its bypass list stays). 0 lets direct pushes in again. Needs `git:admin`.
`GET /v1/orgs/:orgId/repos/:name/access`	Who can reach the repository (docs/repo-access.md): its mode, the people, groups and machines on its list with names for them, and the last change. For those who can read the repository, and for owners (who manage the list without seeing the code).
`PUT /v1/orgs/:orgId/repos/:name/access`	Changes who can reach the repository: org owners only (a break-glass, audited), never through a key or an assistant.
`POST /v1/orgs/:orgId/repos/:name/checks`	Starts checks of a branch in a sandbox: install, then the `typecheck`, `lint`, `test` and `build` scripts (or si.json `checks`). Nothing is deployed. Returns `checkId` (202). Needs `git:write`.
`GET /v1/orgs/:orgId/repos/:name/checks/:checkId`	A check run's status (queued, running, passed, failed, stopped, timed_out), steps and the end of its output (`tail` lines, default 80).
`DELETE /v1/orgs/:orgId/repos/:name/checks/:checkId`	Stops a check run. Needs `git:write`.
`GET /v1/orgs/:orgId/repos/:name/branch-rules`	The branch rules in force (pull requests, approvals, code owners, force-push and deletion blocks, bypass list), whether they were saved or are the defaults, secret scanning (`block` or `off`), and the CODEOWNERS file found at the default branch with its errors.
`PUT /v1/orgs/:orgId/repos/:name/branch-rules`	Replaces the branch rules (up to 20; a name or a prefix ending in `*`) and optionally sets secret scanning. People on a bypass list must be able to write the repository. Open pull requests get the approval rules their target now asks for. Needs `git:admin`.
`POST /v1/orgs/:orgId/repos/:name/secret-scan/allowances`	Says findings a push or commit was refused for aren't secrets: their `fingerprints` (1–20) with a `reason`. Covers your pushes and web commits in this repository for an hour; audited. People only, with `git:write`.
`POST /v1/orgs/:orgId/repos/:name/branches/promote`	Fast-forwards a protected `branch` to the tip of `from` (for pushes too large for the git host to check), never forcing. Only where its rule lets you update it directly (you're on its bypass list, or it doesn't require pull requests), after a secret scan of the changes; audited.
`GET /v1/orgs/:orgId/repos/:name/branches/promote/:promotionId`	A promotion that's still scanning: moves it on, then answers as `POST …/branches/promote` does. Only for whoever began it.
`GET /v1/orgs/:orgId/repos/:name/read-audit`	The repository's read auditing (`all`, `clones` or `off`) and whether owners get clone alerts, defaults filled in.
`PUT /v1/orgs/:orgId/repos/:name/read-audit`	Changes which reads are recorded (`readAudit`) and clone alerts (`cloneAlerts`); audited as `repo.read_audit_update`.
`GET /v1/orgs/:orgId/repos/:name`	Repository details: description, default branch, branches and open issue and pull request counts.
`PATCH /v1/orgs/:orgId/repos/:name`	Updates the description or the default branch.
`GET /v1/orgs/:orgId/repos/:name/tree`	Lists a directory at a branch or commit.
`GET /v1/orgs/:orgId/repos/:name/blob`	A file at a branch or commit. `text` is `null` for binary files and files over 1 MB. `path` is required.
`GET /v1/orgs/:orgId/repos/:name/commits`	First-parent history, newest first. With `path`, only commits that touch that file or folder (`scanned` reports how far the search went). Pass the returned `next` as `cursor` to continue.
`GET /v1/orgs/:orgId/repos/:name/last-commits`	The last commit that touched each entry of a folder. `complete` is `false` while more entries can be resolved by asking again (`pending` counts them, and their entries are `null` until then); once complete, `null` means older than the search reached. When the repository is busy the answer has `head: null` and nothing resolved; ask again.
`GET /v1/orgs/:orgId/repos/:name/last-commit`	The last commit that touched a file. `complete` is `false` while it can still be found by asking again; `head: null` means the repository was busy.
`GET /v1/orgs/:orgId/repos/:name/commits/:sha`	A commit and its changes against its first parent.
`GET /v1/orgs/:orgId/repos/:name/insights`	Contributors, weekly commit activity and languages for a branch (the default branch when `ref` is omitted).