Skip to content
gotifacts

Overview

gotifacts HTTP API 1.0.0

Section titled “gotifacts HTTP API 1.0.0”

Gotifacts exposes two independent HTTP planes:

  • Management plane (/api/*) — used by the browser portal. Authenticated by a forward-auth identity header that your reverse proxy injects (it is honored only from GOTIFACTS_TRUSTED_PROXIES). No API key ever lives in the browser.
  • Ingest plane (/ingest/*) — used by machines (CI, the Claude skill). Authenticated by a scoped API key sent as Authorization: Bearer <key>.

Path parameters named path carry the full site path — the group segments (0–2) followed by the slug, e.g. claude/app, grp/sub/leaf, or demo for a flat site. Total depth (group segments + slug) must be ≤ 3, and each label must match ^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$.

Information

  • License: MIT
  • OpenAPI version: 3.1.0

Operations

Section titled “ Operations ”
GET
/api/me
GET
/api/sites
POST
/api/sites
GET
/api/sites/{path}
DELETE
/api/sites/{path}
PATCH
/api/sites/{path}
GET
/api/sites/deleted
POST
/api/sites/deleted/{path}
DELETE
/api/sites/deleted/{path}
POST
/api/sites/{path}/rollback
GET
/api/sites/{path}/favicon
GET
/api/sites/{path}/revisions
GET
/api/sites/{path}/revisions/{rev}/files
GET
/api/sites/{path}/revisions/{rev}/file
GET
/api/sites/{path}/revisions/{rev}/archive
GET
/api/keys
POST
/api/keys
DELETE
/api/keys/{id}
GET
/api/mcp/consent
POST
/api/mcp/consent
GET
/api/mcp/connections
DELETE
/api/mcp/connections/{id}
POST
/ingest/sites
DELETE
/ingest/sites/{path}
PATCH
/ingest/sites/{path}
GET
/ingest/sites/{path}/revisions
POST
/ingest/sites/{path}/rollback
POST
/ingest/sites/{path}/purge

Authentication

Section titled “ Authentication ”

bearerAuth

Section titled “bearerAuth”

A scoped gotifacts API key (gtf_…) for the ingest plane.

Security scheme type: http

forwardAuth

Section titled “forwardAuth”

The forward-auth identity header injected by your reverse proxy (its name is configurable via GOTIFACTS_FORWARD_AUTH_HEADER). gotifacts honors it only from peers within GOTIFACTS_TRUSTED_PROXIES. Never send this header yourself — your proxy strips any client-supplied copy.

Security scheme type: apiKey

Header parameter name: Remote-User