Documentation
Repository token request
Coming soon. Planned API contract, subject to change. These features are not available yet in production.
Authentication and path
Paths follow /v1/customer/tenants/{tenantId}/sandboxes/{sandboxId}. Requests will use a bearer customer access token or a workspace API key. The sandbox and repository grants below are key permissions, not legacy scopes. A key with all:all will also work, within its creator’s current permissions. The SSH relay uses its ticket instead of a bearer token.
POST /repository-token
The JSON field repository will be required. Use a GitHub owner/name with no URL or .git suffix, at most 140 characters. The optional push field will default to false. The sandbox will need to be running and unexpired. The repository will need authorization in the workspace’s GitHub App installation. Read access will require sandboxes:write plus repositories:read. Push access will require sandboxes:write plus repositories:write. An API key will need to grant both.
200 response
The response will return repository, username=x-access-token, token, expires_at and permission (read or write), with Cache-Control: no-store. Keep the token in memory. It will normally expire in one hour, and GitHub will supply expires_at. It will also work outside the sandbox until it expires. Push will grant contents:write, including branch and tag deletion and releases. It will not grant workflow-file changes. Guest delivery will not be automatic. Never send the token through exec or a Git URL.
Refusals
Invalid requests will return 400. Authentication and permission failures will return 401 or 403. A 404 will mean sandbox_not_found or repository_not_authorized. A sandbox conflict will return 409. Too many attempts will return 429 sandbox_repository_token_rate_limited with Retry-After: 60. Internal errors will return 500. A GitHub failure will return 502 sandbox_repository_token_failed. A disabled feature or missing App configuration will return 503 sandbox_repository_tokens_unavailable. Missing sandbox prerequisites will return sandboxes_unavailable. Planned limits: ten admitted attempts per workspace and five per caller in each rolling minute.