Overview

gotifacts HTTP API (1.0.0)

Gotifacts exposes two independent HTTP planes:

• Management plane (/api/*) — used by the browser portal. Authenticated by a forward-auth identity header that your reverse proxy injects (it is honored only from GOTIFACTS_TRUSTED_PROXIES). No API key ever lives in the browser.
• Ingest plane (/ingest/*) — used by machines (CI, the Claude skill). Authenticated by a scoped API key sent as Authorization: Bearer <key>.

Path parameters named path carry the full site path — the group segments (0–2) followed by the slug, e.g. claude/app, grp/sub/leaf, or demo for a flat site. Total depth (group segments + slug) must be ≤ 3, and each label must match ^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$.

• License: MIT
• OpenAPI version: 3.1.0

Authentication

bearerAuth

A scoped gotifacts API key (gtf_…) for the ingest plane.

Security scheme type: http

forwardAuth

The forward-auth identity header injected by your reverse proxy (its name is configurable via GOTIFACTS_FORWARD_AUTH_HEADER). gotifacts honors it only from peers within GOTIFACTS_TRUSTED_PROXIES. Never send this header yourself — your proxy strips any client-supplied copy.

Security scheme type: apiKey

Header parameter name: Remote-User