Skip to main content
POST
Resolve, hash, and optionally mirror a managed repository source

Authorizations

Authorization
string
header
required

OAuth 2.0 access token obtained through RFC 8628 at /api/auth/device/code and /api/auth/oauth2/token. The API enforces governance:read, session:write, and client-status:write as appropriate.

Body

application/json
source_ref
string
required

Public GitHub source in github:owner/repository@ref form or an immutable public HTTPS .tar.gz URL

Examples:

"github:BlocksOrg/agent-extensions@v1.2.0"

"https://packages.example/extension-1.2.0.tar.gz"

Response

Immutable source metadata for administrator confirmation

source_ref
string<uri>
required
sha256
string
required
Pattern: ^[a-f0-9]{64}$
size_bytes
integer
required
Required range: x <= 104857600
artifact_id
string<uuid>
resolved_commit
string