Information
- License: AGPL-3.0-only
- OpenAPI version:
3.1.0
Overview
SupaCloud Web API 0.6.0
Section titled “SupaCloud Web API 0.6.0”Browser-facing HTTP API consumed by the SupaCloud web UI, plus inbound webhooks (git forges + workflow trigger receivers) under the top-level webhooks key. Generated from the utoipa annotations on the browser handlers (ADR 0044).
Operations
Section titled “Operations”POST
/api/auth/loginPOST
/api/auth/logoutDELETE
/api/v1/org/oidcGET
/api/mePUT
/api/mePATCH
/api/me/verbosityPOST
/api/projectsDELETE
/api/projects/{id}GET
/api/tasksPOST
/api/tasksPOST
/api/tasks/groupDELETE
/api/tasks/{id}POST
/api/workflowsDELETE
/api/workflows/{id}GET
/api/runsGET
/api/runnersPOST
/api/runnersPATCH
/api/runners/configDELETE
/api/runners/{id}POST
/api/schedulesDELETE
/api/schedules/{id}POST
/api/memoriesPOST
/api/workspacesDELETE
/api/workspaces/{id}GET
/api/usagesGET
/api/searchGET
/configGET
/healthGET
/metricsGET
/wsDELETE
/api/organizationDELETE
/api/notifications/{id}POST
/api/resourcesDELETE
/api/resources/{id}GET
/api/scriptsPOST
/api/scriptsDELETE
/api/scripts/{id}PATCH
/api/scripts/{id}DELETE
/api/workspace/repo_syncGET
/api/appsPOST
/api/appsDELETE
/api/apps/{id}POST
/api/councilsPOST
bitbucket repository webhook WEBHOOKPOST
Conversation webhook delivery WEBHOOKPOST
Workflow trigger delivery WEBHOOKPOST
forgejo repository webhook WEBHOOKPOST
Workflow trigger delivery WEBHOOKPOST
github repository webhook WEBHOOKPOST
gitlab repository webhook WEBHOOKPOST
Conversation webhook delivery WEBHOOKPOST
Workflow trigger delivery WEBHOOKPOST
Workflow trigger delivery WEBHOOKAuthentication
Section titled “Authentication”app_token_auth
Section titled “app_token_auth”Per-deployment App API token (scwa_…) for server-side App→API callbacks; alternatively a logged-in session cookie.
Security scheme type: http
Bearer format: scwa
cookie_auth
Section titled “cookie_auth”Security scheme type: apiKey
Cookie parameter name: supacloud_session
webhook_hmac
Section titled “webhook_hmac”HMAC of the raw request body, keyed by the per-trigger / per-project secret (constant-time compared). Header + algorithm are provider-specific: X-Hub-Signature-256 (git forges + generic, SHA256 over the raw body), Linear-Signature (Linear, SHA256), X-Notion-Signature (Notion, SHA256), X-Chatwoot-Signature (Chatwoot, SHA256 over {X-Chatwoot-Timestamp}.{raw_body}, replay-guarded), X-Hub-Signature (Intercom, SHA1 over the raw body).
Security scheme type: apiKey
Header parameter name: X-Hub-Signature-256
webhook_token
Section titled “webhook_token”Unguessable per-trigger token in the final URL path segment; addresses and authenticates the trigger.
Security scheme type: apiKey
Header parameter name: token