Customer API documentation

Getting started

Read the customer API and send live requests against this host. After sign-in, same-origin cookies are included automatically. You can also paste a Bearer rt_live_ token. Click any endpoint row to expand request and response fields. http://api1.truerepos.com.

1. Create an organization
Requires X-Timestamp + X-Signature. Creates only the organization and owner. The response includes credentials on the organization (HTTP Basic) and on the owner (Bearer). Private keys are returned once. The owner password is not returned.
2. Sign in
email, password, optional organization_uuid. Or use the tester form on the right.
3. Invite users
Roles: admin, developer, viewer. Owners are transferred, not invited.
4. Create a repository
type is composer or npm and cannot change later.
5. Create a package
Then publish a version (multipart ZIP/TGZ) or import from Git.

Admin APIs and Billing integration tokens are not part of the customer surface. Switch Audience to All APIs to see them. Path names and JSON fields stay in English.

Authentication

Mode	Applies to	Details
Master API signature	POST /api/v1/organizations	The provisioning client signs the current UTC timestamp with MASTER_API_KEY. Send `X-Timestamp` (unix seconds or ISO-8601) and `X-Signature` = HMAC-SHA256(timestamp + newline + POST + newline + /api/v1/organizations). The timestamp must be within 300 seconds of server time. Never send the master key or signature in the query string.
Owner Bearer or organization credentials	GET /api/v1/organizations/{uuid} and GET/DELETE /api/v1/organizations/{uuid}/members[/{memberUuid}]	Send the owner Bearer token (`rt_live_…`) or the organization credentials from create (`rt_sk_…` as Bearer, or HTTP Basic `repo_…` / `rt_sk_…`). Credentials from another organization are rejected.
Owner, admin, or organization credentials	POST /api/v1/organizations/{uuid}/members and PUT /api/v1/organizations/{uuid}/members/{memberUuid}	Send an owner or admin Bearer token (`rt_live_…`) or the organization credentials from create (`rt_sk_…` as Bearer, or HTTP Basic `repo_…` / `rt_sk_…`). Developers, viewers, and credentials from another organization are rejected.
Owner or admin Bearer (required)	All /api/v1/organizations/{uuid}/repositories endpoints, including settings, domains, IP rules, access, and repository access-keys	Only an active owner or admin Bearer token (`rt_live_…`) is accepted. Organization credentials, developers, and viewers are rejected.
Owner, admin, or developer Bearer (required)	Package, package source, package version, and NPM dist-tag APIs under /api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages	Only an active owner, admin, or developer Bearer token (`rt_live_…`) is accepted. Organization credentials and viewers are rejected.
Owner Bearer (required)	DELETE /api/v1/organizations/{uuid}, subscription, access-keys, Git credentials, access-tokens, authentication-logs, and GET /organizations/{uuid}/repositories/{repositoryUuid}/authorize	Only the organization owner Bearer token (`rt_live_…`) is accepted. Organization credentials, admins, developers, and other members are rejected.
Authenticated member (required)	Every other /api/v1/organizations/{uuid}… endpoint	The default Laravel web guard (`auth`) must resolve a user. That user must be an active member of the organization in the URL, and their role must include the permission listed on the endpoint.
Admin panel is separate	/admin/*	Staff sign-in uses the independent `admin` guard (email, optional 2FA). Admin session cookies cannot call these customer APIs, and customer users cannot open /admin.
Bearer access tokens	Authorization: Bearer rt_live_…	Hashed access tokens authenticate Composer, NPM, and API clients. HTTP Basic username `token` plus the same secret is accepted. Query-string tokens are rejected. The full secret is shown only at create/rotate.
Access keys are HTTP Basic credentials	organization_access_keys	Organization access keys (`repo_…` / `rt_sk_…`) remain copyable HTTP Basic credentials. They can authorize repository requests through the same Access middleware. Only the owner can list, create, revoke, or restore keys on the customer API. Staff can view and copy keys in the admin panel.
Git credentials are not Composer keys	integration_credentials	Git credentials store provider tokens and SSH keys for private package sources. Public APIs never return `secret` or `secret_encrypted`. Only the owner can list, create, update, revoke, or restore credentials on the customer API. Staff can view and copy secrets in the admin panel. Attach a credential to a Git source with `credential_uuid`; never put tokens in package payloads or repository URLs.

Required headers

Accept: application/json
Content-Type: application/json
X-Timestamp: 1710000000
X-Signature: hmac_sha256(MASTER_API_KEY, timestamp + "\n" + POST + "\n" + /api/v1/organizations)

Authenticated request

curl -X GET http://api1.truerepos.com/api/v1/organizations/{organization_uuid} \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

Identifiers

Identifier	Description
Organization UUID	Public identifier. UUIDv7, returned as `data.uuid`. Use it in every organization URL.
Organization slug	Unique URL-friendly name generated from the organization name (`acme-technologies`, then `acme-technologies-2`). Not the canonical identifier.
Internal id	INT UNSIGNED used only for database relationships. Public JSON resources omit it.
Member UUID	Public identifier for a membership. UUIDv7, returned as `data.uuid`. Use it in `/members/{memberUuid}`. Not the user UUID.
Access key UUID	Public identifier for a credential. Username (`repo_…`) and secret (`rt_sk_…`) are returned on create and on later list responses.
Git credential UUID	Public identifier for a vaulted Git token or SSH key. Attach it to package sources as `credential_uuid`. The secret is never returned by the public API.
Access token UUID	Public identifier for a hashed Bearer token. The full `rt_live_` secret is returned only on create and rotate.
Repository UUID	Public identifier (UUIDv7). Use it in every organization-scoped repository URL. Numeric repository ids are never returned.
Repository code	Stable machine identifier (`repo_…`) unique within the organization. Used in Composer/NPM URLs. It does not change when the repository is renamed.
Package UUID	Public identifier (UUIDv7). Always scoped under organization + repository. Numeric package ids are never returned.
Package version UUID	Public identifier for an immutable package version. Active versions cannot be replaced.
Access token UUID	Public identifier for a hashed Bearer token (`rt_live_…`). The full secret is returned only on create and rotate. List/show responses include `token_prefix` only.
Artifact UUID	Public identifier for a package version artifact. Downloads resolve Repository → Package → Version → Artifact → Storage object. Clients never pass storage object IDs or object keys.
Download UUID	Public identifier for one artifact delivery attempt. History APIs never return storage paths or access tokens.
Usage code	storage.bytes, download.bytes, download.count, users.count, repositories.count, packages.count, custom_domains.count. Aggregates are organization-scoped. Source records remain the source of truth.
Operation UUID	Public identifier for business-level background work. Laravel job IDs are never the customer-facing identifier. Clients poll this UUID; they cannot create arbitrary operation types.
Repository code	Public Composer/NPM identifier (repo_…). Protocol URLs use this code, not the internal database ID. Custom domains keep the same path and swap only the host.
Integration token	Dedicated application credentials prefixed rt_int_. Stored as a hash, shown once, and scoped. Never send the secret in a query string.
Idempotency-Key	Required for safe retries of create/update operations. Unique per integration. The same key with a different payload returns duplicate_request.
Custom domain UUID	Public identifier (UUIDv7) for an organization hostname. Numeric ids are never returned. Verification token hashes are never returned.
Audit UUID	Public identifier (UUIDv7) for an append-only accountability event. Numeric ids are never returned. Secrets and tokens are never stored.
Notification UUID	Public identifier (UUIDv7) for an in-app notification. Numeric ids are never returned. Secrets and tokens are never stored in notification data.
Admin APIs	Session-authenticated administrator endpoints. Organization users, customer tokens, and repository tokens cannot access these routes. Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Roles and permissions

Authorization uses permission codes, never hardcoded role IDs.

Role	Access
owner	All permissions, including organization.delete and organization.transfer_ownership.
admin	Operational permissions except organization.delete and organization.transfer_ownership.
developer	Repository view/update and package, access-key, access-token, and Git-credential work. No repository create/archive/settings manage, and no billing administration.
viewer	Read-only: organization, members, repositories, packages, access keys, access tokens, auth logs, Git credentials, usage, audit, and billing.view.

organization.view organization.update organization.delete organization.transfer_ownership member.view member.create member.update member.delete repository.view repository.create repository.update repository.delete repository.archive repository.suspend repository.settings.view repository.settings.manage repository.access.view repository.access.manage repository.domain.view repository.domain.manage custom_domain.view custom_domain.manage repository.ip_whitelist.view repository.ip_whitelist.manage package.view package.create package.update package.delete package.archive package.source.view package.source.create package.source.update package.source.delete package.source.test package.source.sync package.version.view package.version.publish package.version.import package.version.deprecate package.version.archive package.dist_tag.manage access_key.view access_key.create access_key.revoke access_token.view access_token.create access_token.revoke access_token.rotate authentication_log.view download.view credential.view credential.create credential.update credential.revoke usage.view operation.view operation.cancel operation.retry operation.manage audit.view billing.view billing.manage

The user belongs to the organization in the URL.
Membership status is active.
The role is active.
The role includes the permission code documented on the endpoint.

Errors

Status	When	Body
401	Missing or invalid user session on a protected endpoint.	{"message":"Unauthenticated."}
403	Authenticated, but not an active member or missing the permission.	{"message":"This action is unauthorized."}
404	Unknown organization UUID, or a member/access key that does not belong to that organization.	{"message":"No query results for model [App\\Modules\\Organization\\Models\\Organization]."}
409	Duplicate membership, or the organization is not active.	{"message":"This user is already a member of the organization.","code":"duplicate_membership"}
422	Validation failure, owner removal, or member limit reached.	{"message":"The name field is required.","errors":{"name":["The name field is required."]}}

Organizations

Create a tenant, read it by UUID, update profile fields, or permanently delete it and all of its data.

POST /organizations Create an organization and its owner

Create an organization and its owner

Creates the organization and a new owner user. Also issues a one-time owner Bearer token and an organization API key for later requests. The organization is created active and verified. This endpoint does not create a subscription; assign a plan later from admin or billing.

Master API signature No permission check application/json

X-Timestamp and X-Signature are required. Signature is HMAC-SHA256 of `timestamp\nPOST\n/api/v1/organizations` using MASTER_API_KEY. Timestamps older than 300 seconds are rejected.
Only the organization and owner user are created. No additional members are invited.
Private keys are returned only on this create response. Store them immediately.
`data.owner.credentials.private_key` is the Bearer token. Send `Authorization: Bearer {private_key}` on later REST APIs.
`data.credentials` is HTTP Basic for Composer/NPM: username `public_key`, password `private_key`.
No subscription is created. Repository and package limits apply only after a plan is assigned.
Organization `email` must be unique (case-insensitive). A second create with the same contact email returns 422.
`owner_email` must be unique. If that user already exists, create returns 422.
A new owner password is generated server-side and is not returned. Call `POST /auth/forgot-password` to set a login password.
Internal numeric `id` is not returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
X-Timestamp	string	required	Current UTC time as unix seconds (recommended) or ISO-8601. Must be within 300 seconds of the server clock.	1793434223
X-Signature	string	required	HMAC-SHA256 hex digest of `timestamp + newline + POST + newline + /api/v1/organizations` using MASTER_API_KEY from the Laravel environment. Do not send the raw key.	a1b2c3…

Request body fields

Field	Type	Required	Description	Example
name	string	required	Display name. Maximum 191 characters unless noted otherwise.	Acme Technologies
owner_name	string	required	Owner full name. Creates or reuses the user for owner_email.	Raju
owner_email	email	required	Owner email. Must not already exist. A new user gets a generated password that is not returned.	[email protected]
email	email	optional	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]
phone	string	optional	Contact phone. Maximum 50 characters.	+1-555-0100
website	url	optional	Organization website. Must be a valid URL.	https://acme.test
country_code	string	optional	ISO 3166-1 alpha-2 country code.	US
timezone	string	optional	IANA timezone such as UTC or Asia/Kolkata.	UTC
external_reference	string	optional	Optional external ID from another system.	null

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	01995f4c-7f7a-7c9c-8f66-1d1c412e50fe
data.name	string	Display name. Maximum 191 characters unless noted otherwise.	Acme Technologies
data.slug	string	URL-friendly unique name generated from the display name.	acme-technologies
data.status	string	Lifecycle status for this resource.	active
data.verification_status	string	Organization verification state. Free plans are verified immediately.	verified
data.credentials.cred_type	string	Credential kind. `bearer` is Authorization: Bearer. `basic` is HTTP Basic username/password.	basic
data.credentials.public_key	string	Non-secret identifier. Bearer: token prefix. Basic: `repo_…` username.	repo_…
data.credentials.private_key	string	Secret returned only on create. Bearer: full `rt_live_…` token. Basic: `rt_sk_…` password.	rt_sk_…
data.owner.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	01995f4c-7f7a-7c9c-8f66-1d1c412e50ff
data.owner.name	string	Display name. Maximum 191 characters unless noted otherwise.	Raju
data.owner.email	email	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]
data.owner.status	string	Lifecycle status for this resource.	active
data.owner.credentials.cred_type	string	Credential kind. `bearer` is Authorization: Bearer. `basic` is HTTP Basic username/password.	bearer
data.owner.credentials.public_key	string	Non-secret identifier. Bearer: token prefix. Basic: `repo_…` username.	rt_live_abcd1234
data.owner.credentials.private_key	string	Secret returned only on create. Bearer: full `rt_live_…` token. Basic: `rt_sk_…` password.	rt_live_…

Response 201 example

{
    "data": {
        "uuid": "01995f4c-7f7a-7c9c-8f66-1d1c412e50fe",
        "name": "Acme Technologies",
        "slug": "acme-technologies",
        "status": "active",
        "verification_status": "verified",
        "credentials": {
            "cred_type": "basic",
            "public_key": "repo_\u2026",
            "private_key": "rt_sk_\u2026"
        },
        "owner": {
            "uuid": "01995f4c-7f7a-7c9c-8f66-1d1c412e50ff",
            "name": "Raju",
            "email": "[email protected]",
            "status": "active",
            "credentials": {
                "cred_type": "bearer",
                "public_key": "rt_live_abcd1234",
                "private_key": "rt_live_\u2026"
            }
        }
    }
}

Request JSON example

{
    "name": "Acme Technologies",
    "owner_name": "Raju",
    "owner_email": "[email protected]",
    "email": "[email protected]",
    "phone": "+1-555-0100",
    "website": "https://acme.test",
    "country_code": "US",
    "timezone": "UTC",
    "external_reference": null
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations" \
  -H "Accept: application/json" \
  -H "X-Timestamp: 1710000000" \
  -H "X-Signature: HMAC_SHA256_HEX" \
  -H "Content-Type: application/json" \
  -d '{"name":"Acme Technologies","owner_name":"Raju","owner_email":"[email protected]","email":"[email protected]","phone":"+1-555-0100","website":"https://acme.test","country_code":"US","timezone":"UTC","external_reference":null}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'X-Timestamp: 1710000000',
        'X-Signature: HMAC_SHA256_HEX',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"name":"Acme Technologies","owner_name":"Raju","owner_email":"[email protected]","email":"[email protected]","phone":"+1-555-0100","website":"https://acme.test","country_code":"US","timezone":"UTC","external_reference":null}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'X-Timestamp': '1710000000',
    'X-Signature': 'HMAC_SHA256_HEX',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Acme Technologies",
    "owner_name": "Raju",
    "owner_email": "[email protected]",
    "email": "[email protected]",
    "phone": "+1-555-0100",
    "website": "https://acme.test",
    "country_code": "US",
    "timezone": "UTC",
    "external_reference": null
}),
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid} Get one organization

Get one organization

Returns the organization identified by UUID, including the current subscription when loaded. Authenticate with the owner Bearer token or the organization credentials returned on create.

Owner Bearer or organization credentials organization.view

Owner: `Authorization: Bearer {data.owner.credentials.private_key}` (`rt_live_…`).
Organization: `Authorization: Bearer {data.credentials.private_key}` (`rt_sk_…`) or HTTP Basic username `public_key` / password `private_key`.
Credentials from another organization are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` or organization `rt_sk_…` (Bearer or HTTP Basic with repo_ username). Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	01995f4c-7f7a-7c9c-8f66-1d1c412e50fe
data.name	string	Display name. Maximum 191 characters unless noted otherwise.	Acme Technologies
data.slug	string	URL-friendly unique name generated from the display name.	acme-technologies
data.status	string	Lifecycle status for this resource.	active
data.verification_status	string	Organization verification state. Free plans are verified immediately.	verified

Response 200 example

{
    "data": {
        "uuid": "01995f4c-7f7a-7c9c-8f66-1d1c412e50fe",
        "name": "Acme Technologies",
        "slug": "acme-technologies",
        "status": "active",
        "verification_status": "verified"
    }
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_rt_sk_ORGANIZATION"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_rt_sk_ORGANIZATION',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_rt_sk_ORGANIZATION',
  },
});

const payload = await response.json();
console.log(payload);

PUT /organizations/{uuid} Update organization profile

Update organization profile

Updates name, email, phone, website, country, and timezone. Does not change plan, status, or ownership.

Authenticated member organization.update application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Request body fields

Field	Type	Required	Description	Example
website	url	optional	Organization website. Must be a valid URL.	https://acme.test
timezone	string	optional	IANA timezone such as UTC or Asia/Kolkata.	Asia/Kolkata

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	01995f4c-7f7a-7c9c-8f66-1d1c412e50fe
data.website	url	Organization website. Must be a valid URL.	https://acme.test
data.timezone	string	IANA timezone such as UTC or Asia/Kolkata.	Asia/Kolkata

Response 200 example

{
    "data": {
        "uuid": "01995f4c-7f7a-7c9c-8f66-1d1c412e50fe",
        "website": "https://acme.test",
        "timezone": "Asia/Kolkata"
    }
}

Request JSON example

{
    "website": "https://acme.test",
    "timezone": "Asia/Kolkata"
}

Code examples

curl -X PUT "http://api1.truerepos.com/api/v1/organizations/{uuid}" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d '{"website":"https://acme.test","timezone":"Asia/Kolkata"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"website":"https://acme.test","timezone":"Asia/Kolkata"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}', {
  method: 'PUT',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "website": "https://acme.test",
    "timezone": "Asia/Kolkata"
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid} Delete an organization

Delete an organization

Permanently deletes the organization and all of its tenant data: members, subscriptions, access keys, tokens, repositories, packages, storage objects, credentials, and related records. This cannot be undone. The owner user account is not deleted.

Owner Bearer organization.delete

Only the organization owner Bearer token (`rt_live_…`) is accepted.
Organization credentials, admins, developers, and other members are rejected.
A later GET of the same UUID returns 404. Owner tokens issued for that organization are removed with it.
Member user accounts are left in place; only memberships and organization-owned data are removed.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

Members

Invite people into an organization. One user cannot hold two memberships in the same organization.

GET /organizations/{uuid}/members List members

List members

Returns memberships for this organization only. Name, email, and user_uuid are flattened onto each member. Authenticate with the owner Bearer token or the organization credentials returned on create.

Owner Bearer or organization credentials member.view

Owner: `Authorization: Bearer {data.owner.credentials.private_key}` (`rt_live_…`).
Organization: `Authorization: Bearer {data.credentials.private_key}` (`rt_sk_…`) or HTTP Basic username `public_key` / password `private_key`.
Credentials from another organization are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` or organization `rt_sk_…` (Bearer or HTTP Basic with repo_ username). Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response fields

Field	Type	Description	Example
data[].uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	01a0e3e1-0826-7064-ac55-dd3d6cbe0ae3
data[].status	string	Lifecycle status for this resource.	active
data[].user_uuid	uuid	Public user UUID (UUIDv7). On access tokens, required for user and admin types.	01a0e269-a4dc-7294-939b-ebb2c5b4995d
data[].name	string	Display name. Maximum 191 characters unless noted otherwise.	Raju
data[].email	email	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]
data[].invited_at	datetime	When the member was invited.	null
data[].joined_at	datetime	When the member accepted and became active.	2026-09-27T10:29:29.000000Z
data[].created_at	datetime	Created timestamp (UTC).	2026-09-27T10:29:29.000000Z
data[].role.code	string	Stable machine identifier or usage/entitlement code.	owner
data[].role.name	string	Display name. Maximum 191 characters unless noted otherwise.	Owner

Response 200 example

{
    "data": [
        {
            "uuid": "01a0e3e1-0826-7064-ac55-dd3d6cbe0ae3",
            "status": "active",
            "user_uuid": "01a0e269-a4dc-7294-939b-ebb2c5b4995d",
            "name": "Raju",
            "email": "[email protected]",
            "invited_at": null,
            "joined_at": "2026-09-27T10:29:29.000000Z",
            "created_at": "2026-09-27T10:29:29.000000Z",
            "role": {
                "code": "owner",
                "name": "Owner"
            }
        }
    ]
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/members" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_rt_sk_ORGANIZATION"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/members');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_rt_sk_ORGANIZATION',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/members', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_rt_sk_ORGANIZATION',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/members Invite a member

Invite a member

Finds or creates the user by email and creates an invited membership. Role cannot be `owner` — transfer ownership with the dedicated action instead. Duplicate memberships return 409. Authenticate with an owner or admin Bearer token or the organization credentials returned on create.

Owner, admin, or organization credentials member.create application/json

Allowed role_code values: admin, developer, viewer.
Owner or admin: `Authorization: Bearer {data.owner.credentials.private_key}` (`rt_live_…`). An organization admin Bearer token is also accepted.
Organization: `Authorization: Bearer {data.credentials.private_key}` (`rt_sk_…`) or HTTP Basic username `public_key` / password `private_key`.
Developers, viewers, and credentials from another organization are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` or organization `rt_sk_…` (Bearer or HTTP Basic with repo_ username). Developers and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Request body fields

Field	Type	Required	Description	Example
name	string	required	Display name. Maximum 191 characters unless noted otherwise.	Alex Chen
email	email	optional	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]
role_code	string	required	Member role. Allowed: admin, developer, viewer. owner cannot be invited.	developer

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	01a0e269-b4dc-7294-939b-ebb2c5b4995e
data.status	string	Lifecycle status for this resource.	invited
data.user_uuid	uuid	Public user UUID (UUIDv7). On access tokens, required for user and admin types.	01a0e269-c4dc-7294-939b-ebb2c5b4995f
data.name	string	Display name. Maximum 191 characters unless noted otherwise.	Alex Chen
data.email	email	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]
data.invited_at	datetime	When the member was invited.	2026-09-27T10:31:00.000000Z
data.joined_at	datetime	When the member accepted and became active.	null
data.created_at	datetime	Created timestamp (UTC).	2026-09-27T10:31:00.000000Z
data.role.code	string	Stable machine identifier or usage/entitlement code.	developer
data.role.name	string	Display name. Maximum 191 characters unless noted otherwise.	Developer

Response 201 example

{
    "data": {
        "uuid": "01a0e269-b4dc-7294-939b-ebb2c5b4995e",
        "status": "invited",
        "user_uuid": "01a0e269-c4dc-7294-939b-ebb2c5b4995f",
        "name": "Alex Chen",
        "email": "[email protected]",
        "invited_at": "2026-09-27T10:31:00.000000Z",
        "joined_at": null,
        "created_at": "2026-09-27T10:31:00.000000Z",
        "role": {
            "code": "developer",
            "name": "Developer"
        }
    }
}

Request JSON example

{
    "name": "Alex Chen",
    "email": "[email protected]",
    "role_code": "developer"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/members" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN_OR_rt_sk_ORGANIZATION" \
  -H "Content-Type: application/json" \
  -d '{"name":"Alex Chen","email":"[email protected]","role_code":"developer"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/members');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN_OR_rt_sk_ORGANIZATION',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"name":"Alex Chen","email":"[email protected]","role_code":"developer"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/members', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN_OR_rt_sk_ORGANIZATION',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Alex Chen",
    "email": "[email protected]",
    "role_code": "developer"
}),
});

const payload = await response.json();
console.log(payload);

PUT /organizations/{uuid}/members/{memberUuid} Change a member role

Change a member role

{memberUuid} is the membership UUID. The membership must belong to the organization UUID in the URL. Authenticate with an owner or admin Bearer token or the organization credentials returned on create.

Owner, admin, or organization credentials member.update application/json

Owner or admin: `Authorization: Bearer {data.owner.credentials.private_key}` (`rt_live_…`). An organization admin Bearer token is also accepted.
Organization: `Authorization: Bearer {data.credentials.private_key}` (`rt_sk_…`) or HTTP Basic username `public_key` / password `private_key`.
Developers, viewers, and credentials from another organization are rejected.
The owner membership cannot be changed here. Transfer ownership instead.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` or organization `rt_sk_…` (Bearer or HTTP Basic with repo_ username). Developers and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
memberUuid	uuid	required	Membership public ID (UUIDv7), scoped to the organization in the URL. Not the user UUID.	01a0e269-a4dc-7294-939b-ebb2c5b4995d

Request body fields

Field	Type	Required	Description	Example
role_code	string	required	Member role. Allowed: admin, developer, viewer. owner cannot be invited.	viewer

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	01a0e269-b4dc-7294-939b-ebb2c5b4995e
data.status	string	Lifecycle status for this resource.	active
data.user_uuid	uuid	Public user UUID (UUIDv7). On access tokens, required for user and admin types.	01a0e269-c4dc-7294-939b-ebb2c5b4995f
data.name	string	Display name. Maximum 191 characters unless noted otherwise.	Alex Chen
data.email	email	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]
data.role.code	string	Stable machine identifier or usage/entitlement code.	viewer
data.role.name	string	Display name. Maximum 191 characters unless noted otherwise.	Viewer

Response 200 example

{
    "data": {
        "uuid": "01a0e269-b4dc-7294-939b-ebb2c5b4995e",
        "status": "active",
        "user_uuid": "01a0e269-c4dc-7294-939b-ebb2c5b4995f",
        "name": "Alex Chen",
        "email": "[email protected]",
        "role": {
            "code": "viewer",
            "name": "Viewer"
        }
    }
}

Request JSON example

{
    "role_code": "viewer"
}

Code examples

curl -X PUT "http://api1.truerepos.com/api/v1/organizations/{uuid}/members/{memberUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN_OR_rt_sk_ORGANIZATION" \
  -H "Content-Type: application/json" \
  -d '{"role_code":"viewer"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/members/{memberUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN_OR_rt_sk_ORGANIZATION',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"role_code":"viewer"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/members/{memberUuid}', {
  method: 'PUT',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN_OR_rt_sk_ORGANIZATION',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "role_code": "viewer"
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/members/{memberUuid} Remove a member

Remove a member

Soft-deletes the membership. The active owner cannot be removed (422, code owner_cannot_be_removed). Authenticate with the owner Bearer token or the organization credentials returned on create.

Owner Bearer or organization credentials member.delete

Owner: `Authorization: Bearer {data.owner.credentials.private_key}` (`rt_live_…`).
Organization: `Authorization: Bearer {data.credentials.private_key}` (`rt_sk_…`) or HTTP Basic username `public_key` / password `private_key`.
Credentials from another organization are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` or organization `rt_sk_…` (Bearer or HTTP Basic with repo_ username). Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
memberUuid	uuid	required	Membership public ID (UUIDv7), scoped to the organization in the URL. Not the user UUID.	01a0e269-a4dc-7294-939b-ebb2c5b4995d

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/members/{memberUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_rt_sk_ORGANIZATION"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/members/{memberUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_rt_sk_ORGANIZATION',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/members/{memberUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_rt_sk_ORGANIZATION',
  },
});

const payload = await response.json();
console.log(payload);

Subscription

Current entitlement snapshot. Limits are copied from the plan at assign time and are not recalculated from later catalog edits. Create, update, and delete are owner-only.

GET /organizations/{uuid}/subscription Get the organization subscription

Get the organization subscription

Returns the active subscription, including snapshotted user/storage/download/domain/IP limits and the plan code. Only the organization owner may call this endpoint.

Owner Bearer billing.view

`user_limit` of 0 means unlimited. Domain and IP limits of 0 mean none allowed.
Owner: `Authorization: Bearer {data.owner.credentials.private_key}` (`rt_live_…`).
Organization credentials and non-owner members are rejected.
Returns 404 when the organization has no active subscription.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data.status	string	Lifecycle status for this resource.	active
data.plan.code	string	Stable machine identifier or usage/entitlement code.	free
data.plan.name	string	Display name. Maximum 191 characters unless noted otherwise.	Free
data.user_limit	integer	Snapshotted member limit. Null is unlimited; 0 means none.	3
data.storage_limit_bytes	integer	Snapshotted storage entitlement in bytes.	1073741824
data.custom_domain_limit	integer	Snapshotted custom domain limit.	0
data.whitelist_ip_limit	integer	Snapshotted IP allow-list limit.	0

Response 200 example

{
    "data": {
        "uuid": "\u2026",
        "status": "active",
        "plan": {
            "code": "free",
            "name": "Free"
        },
        "user_limit": 3,
        "storage_limit_bytes": 1073741824,
        "custom_domain_limit": 0,
        "whitelist_ip_limit": 0
    }
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/subscription Create the organization subscription

Create the organization subscription

Assigns an active plan and snapshots its limits onto a new subscription. Only the organization owner may call this endpoint. Fails if an active subscription already exists.

Owner Bearer billing.manage application/json

`plan_code` must match an active plan (`free`, `basic`, `pro`, `custom`).
Returns 409 when an active subscription already exists. Use PUT to change plans.
Owner: `Authorization: Bearer {data.owner.credentials.private_key}` (`rt_live_…`).

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Request body fields

Field	Type	Required	Description	Example
plan_code	string	optional	Plan code. Not accepted on POST /organizations. Values: free, basic, pro, custom.	free

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data.status	string	Lifecycle status for this resource.	active
data.plan.code	string	Stable machine identifier or usage/entitlement code.	free
data.plan.name	string	Display name. Maximum 191 characters unless noted otherwise.	Free
data.user_limit	integer	Snapshotted member limit. Null is unlimited; 0 means none.	3

Response 201 example

{
    "data": {
        "uuid": "\u2026",
        "status": "active",
        "plan": {
            "code": "free",
            "name": "Free"
        },
        "user_limit": 3
    }
}

Request JSON example

{
    "plan_code": "free"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER" \
  -H "Content-Type: application/json" \
  -d '{"plan_code":"free"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"plan_code":"free"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "plan_code": "free"
}),
});

const payload = await response.json();
console.log(payload);

PUT /organizations/{uuid}/subscription Update the organization subscription

Update the organization subscription

Cancels the active subscription and assigns a new plan with a fresh limit snapshot. Only the organization owner may call this endpoint.

Owner Bearer billing.manage application/json

Returns 404 when there is no active subscription. Create one with POST first.
Owner: `Authorization: Bearer {data.owner.credentials.private_key}` (`rt_live_…`).

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Request body fields

Field	Type	Required	Description	Example
plan_code	string	optional	Plan code. Not accepted on POST /organizations. Values: free, basic, pro, custom.	pro

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data.status	string	Lifecycle status for this resource.	active
data.plan.code	string	Stable machine identifier or usage/entitlement code.	pro
data.plan.name	string	Display name. Maximum 191 characters unless noted otherwise.	Pro

Response 200 example

{
    "data": {
        "uuid": "\u2026",
        "status": "active",
        "plan": {
            "code": "pro",
            "name": "Pro"
        }
    }
}

Request JSON example

{
    "plan_code": "pro"
}

Code examples

curl -X PUT "http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER" \
  -H "Content-Type: application/json" \
  -d '{"plan_code":"pro"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"plan_code":"pro"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription', {
  method: 'PUT',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "plan_code": "pro"
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/subscription Delete the organization subscription

Delete the organization subscription

Cancels the active subscription. Later GET requests return 404 until a new plan is assigned. Only the organization owner may call this endpoint.

Owner Bearer billing.manage

Returns 404 when there is no active subscription.
Owner: `Authorization: Bearer {data.owner.credentials.private_key}` (`rt_live_…`).

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/subscription', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

Access keys

Credentials for Composer clients, CI, and future API integrations. Username and secret can be retrieved later from this API and from the admin panel.

GET /organizations/{uuid}/access-keys List access keys

List access keys

Returns each key including `username` and `secret`. `secret_hash` and `secret_encrypted` are never included. Only the organization owner may call this endpoint.

Owner Bearer access_key.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response fields

Field	Type	Description	Example
data[].uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data[].name	string	Display name. Maximum 191 characters unless noted otherwise.	Production Composer
data[].type	string	Resource type. Repository type is composer or npm and cannot change later.	composer
data[].username	string	Optional username for the credential, or HTTP Basic username for an access key.	repo_01K5C7JQ9A4M2…
data[].secret	string	Write-only secret. Public APIs never return secret or secret_encrypted.	rt_sk_y8JV9nCr79…
data[].status	string	Lifecycle status for this resource.	active

Response 200 example

{
    "data": [
        {
            "uuid": "\u2026",
            "name": "Production Composer",
            "type": "composer",
            "username": "repo_01K5C7JQ9A4M2\u2026",
            "secret": "rt_sk_y8JV9nCr79\u2026",
            "status": "active"
        }
    ]
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/access-keys Create an access key

Create an access key

Generates a public identifier (`repo_…`) and a cryptographically random secret (`rt_sk_…`). Both stay available on later list responses and in the admin panel. Only the organization owner may call this endpoint.

Owner Bearer access_key.create application/json

`type` may be composer, api, basic_auth, or automation. Default is composer.
The organization must be active.
Owner: `Authorization: Bearer {data.owner.credentials.private_key}` (`rt_live_…`).
Organization credentials and non-owner members are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Request body fields

Field	Type	Required	Description	Example
name	string	required	Display name. Maximum 191 characters unless noted otherwise.	Production Composer
type	string	required	Resource type. Repository type is composer or npm and cannot change later.	composer
expires_at	datetime	optional	Optional expiration. Must be in the future.	null

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data.name	string	Display name. Maximum 191 characters unless noted otherwise.	Production Composer
data.username	string	Optional username for the credential, or HTTP Basic username for an access key.	repo_01K5C7JQ9A4M2…
data.secret	string	Write-only secret. Public APIs never return secret or secret_encrypted.	rt_sk_y8JV9nCr79…
data.status	string	Lifecycle status for this resource.	active

Response 201 example

{
    "data": {
        "uuid": "\u2026",
        "name": "Production Composer",
        "username": "repo_01K5C7JQ9A4M2\u2026",
        "secret": "rt_sk_y8JV9nCr79\u2026",
        "status": "active"
    }
}

Request JSON example

{
    "name": "Production Composer",
    "type": "composer",
    "expires_at": null
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER" \
  -H "Content-Type: application/json" \
  -d '{"name":"Production Composer","type":"composer","expires_at":null}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"name":"Production Composer","type":"composer","expires_at":null}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Production Composer",
    "type": "composer",
    "expires_at": null
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/access-keys/{accessKeyUuid} Revoke an access key

Revoke an access key

Sets status to revoked and records revoked_at. Restore it later to make the same username and secret active again. Only the organization owner may call this endpoint.

Owner Bearer access_key.revoke

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
accessKeyUuid	uuid	required	Organization access key public ID.	01a0c9ee-b300-7000-8000-000000000004

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys/{accessKeyUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys/{accessKeyUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys/{accessKeyUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/access-keys/{accessKeyUuid}/restore Restore a revoked access key

Restore a revoked access key

Clears revoked_at and sets the key back to active (or expired if its expiry date has passed). Username and secret stay the same. Only the organization owner may call this endpoint.

Owner Bearer access_key.revoke

Requires the owner Bearer token. The organization must be active.
The key must currently be revoked.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
accessKeyUuid	uuid	required	Organization access key public ID.	01a0c9ee-b300-7000-8000-000000000004

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data.name	string	Display name. Maximum 191 characters unless noted otherwise.	CI
data.username	string	Optional username for the credential, or HTTP Basic username for an access key.	repo_01K5C7JQ9A4M2…
data.secret	string	Write-only secret. Public APIs never return secret or secret_encrypted.	rt_sk_y8JV9nCr79…
data.status	string	Lifecycle status for this resource.	active
data.revoked_at	string	Revoked at	null

Response 200 example

{
    "data": {
        "uuid": "\u2026",
        "name": "CI",
        "username": "repo_01K5C7JQ9A4M2\u2026",
        "secret": "rt_sk_y8JV9nCr79\u2026",
        "status": "active",
        "revoked_at": null
    }
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys/{accessKeyUuid}/restore" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys/{accessKeyUuid}/restore');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-keys/{accessKeyUuid}/restore', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

Git credentials

Org-scoped vault for GitHub, Bitbucket, GitLab, and generic Git tokens or SSH keys. Secrets are encrypted at rest. Public JSON never includes the secret.

GET /organizations/{uuid}/credentials List Git credentials

List Git credentials

Returns metadata including `secret_hint`. `secret` and `secret_encrypted` are never included. Only the organization owner may call this endpoint.

Owner Bearer credential.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response fields

Field	Type	Description	Example
data[].uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data[].name	string	Display name. Maximum 191 characters unless noted otherwise.	Bitbucket CI
data[].provider	string	Git provider: github, bitbucket, gitlab, or generic_git.	bitbucket
data[].type	string	Resource type. Repository type is composer or npm and cannot change later.	https_token
data[].username	string	Optional username for the credential, or HTTP Basic username for an access key.	x-token-auth
data[].secret_hint	string	Secret hint	••••a1b2
data[].status	string	Lifecycle status for this resource.	active

Response 200 example

{
    "data": [
        {
            "uuid": "\u2026",
            "name": "Bitbucket CI",
            "provider": "bitbucket",
            "type": "https_token",
            "username": "x-token-auth",
            "secret_hint": "\u2022\u2022\u2022\u2022a1b2",
            "status": "active"
        }
    ]
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/credentials Store a Git credential

Store a Git credential

Encrypts the secret. Username defaults by provider (GitHub `x-access-token`, GitLab `oauth2`, Bitbucket `x-token-auth`). The plaintext secret is not returned. Only the organization owner may call this endpoint.

Owner Bearer credential.create application/json

`provider` may be github, bitbucket, gitlab, or generic_git.
`type` may be https_token, oauth, ssh_key, provider_app, or deploy_token.
Attach the returned UUID to a package Git source as `credential_uuid`.
Owner: `Authorization: Bearer {data.owner.credentials.private_key}` (`rt_live_…`).
Organization credentials and non-owner members are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Request body fields

Field	Type	Required	Description	Example
name	string	required	Display name. Maximum 191 characters unless noted otherwise.	Bitbucket CI
provider	string	optional	Git provider: github, bitbucket, gitlab, or generic_git.	bitbucket
type	string	required	Resource type. Repository type is composer or npm and cannot change later.	https_token
secret	string	required	Write-only secret. Public APIs never return secret or secret_encrypted.	bbat_example_token

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data.name	string	Display name. Maximum 191 characters unless noted otherwise.	Bitbucket CI
data.provider	string	Git provider: github, bitbucket, gitlab, or generic_git.	bitbucket
data.type	string	Resource type. Repository type is composer or npm and cannot change later.	https_token
data.username	string	Optional username for the credential, or HTTP Basic username for an access key.	x-token-auth
data.secret_hint	string	Secret hint	••••oken
data.status	string	Lifecycle status for this resource.	active

Response 201 example

{
    "data": {
        "uuid": "\u2026",
        "name": "Bitbucket CI",
        "provider": "bitbucket",
        "type": "https_token",
        "username": "x-token-auth",
        "secret_hint": "\u2022\u2022\u2022\u2022oken",
        "status": "active"
    }
}

Request JSON example

{
    "name": "Bitbucket CI",
    "provider": "bitbucket",
    "type": "https_token",
    "secret": "bbat_example_token"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER" \
  -H "Content-Type: application/json" \
  -d '{"name":"Bitbucket CI","provider":"bitbucket","type":"https_token","secret":"bbat_example_token"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"name":"Bitbucket CI","provider":"bitbucket","type":"https_token","secret":"bbat_example_token"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Bitbucket CI",
    "provider": "bitbucket",
    "type": "https_token",
    "secret": "bbat_example_token"
}),
});

const payload = await response.json();
console.log(payload);

PUT /organizations/{uuid}/credentials/{credentialUuid} Update a Git credential

Update a Git credential

Updates name, username, and/or secret. Provider and type cannot change. Only the organization owner may call this endpoint.

Owner Bearer credential.update application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
credentialUuid	uuid	required	Git credential public ID. The secret is never returned by the public API.	01a0c9ee-b400-7000-8000-000000000005

Request body fields

Field	Type	Required	Description	Example
name	string	required	Display name. Maximum 191 characters unless noted otherwise.	Bitbucket CI (rotated)
secret	string	required	Write-only secret. Public APIs never return secret or secret_encrypted.	bbat_new_token

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data.name	string	Display name. Maximum 191 characters unless noted otherwise.	Bitbucket CI (rotated)
data.secret_hint	string	Secret hint	••••oken

Response 200 example

{
    "data": {
        "uuid": "\u2026",
        "name": "Bitbucket CI (rotated)",
        "secret_hint": "\u2022\u2022\u2022\u2022oken"
    }
}

Request JSON example

{
    "name": "Bitbucket CI (rotated)",
    "secret": "bbat_new_token"
}

Code examples

curl -X PUT "http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials/{credentialUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER" \
  -H "Content-Type: application/json" \
  -d '{"name":"Bitbucket CI (rotated)","secret":"bbat_new_token"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials/{credentialUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"name":"Bitbucket CI (rotated)","secret":"bbat_new_token"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials/{credentialUuid}', {
  method: 'PUT',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Bitbucket CI (rotated)",
    "secret": "bbat_new_token"
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/credentials/{credentialUuid} Revoke a Git credential

Revoke a Git credential

Sets status to revoked. Attached package sources keep the UUID, but Git operations fail until a new credential is attached or this one is restored. Only the organization owner may call this endpoint.

Owner Bearer credential.revoke

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
credentialUuid	uuid	required	Git credential public ID. The secret is never returned by the public API.	01a0c9ee-b400-7000-8000-000000000005

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials/{credentialUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials/{credentialUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials/{credentialUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/credentials/{credentialUuid}/restore Restore a revoked Git credential

Restore a revoked Git credential

Clears revoked_at and sets the credential back to active. The secret is unchanged. Only the organization owner may call this endpoint.

Owner Bearer credential.revoke

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
credentialUuid	uuid	required	Git credential public ID. The secret is never returned by the public API.	01a0c9ee-b400-7000-8000-000000000005

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data.name	string	Display name. Maximum 191 characters unless noted otherwise.	Bitbucket CI
data.status	string	Lifecycle status for this resource.	active
data.revoked_at	string	Revoked at	null

Response 200 example

{
    "data": {
        "uuid": "\u2026",
        "name": "Bitbucket CI",
        "status": "active",
        "revoked_at": null
    }
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials/{credentialUuid}/restore" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials/{credentialUuid}/restore');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/credentials/{credentialUuid}/restore', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

Repositories

Composer and NPM repositories owned by an organization. Type is immutable. DELETE archives the repository.

GET /organizations/{uuid}/repositories List repositories

List repositories

Returns repositories for the organization in the URL. Cross-organization UUIDs 404 because the query is scoped to that tenant.

Owner or admin Bearer repository.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories Create a repository

Create a repository

Creates a Composer or NPM repository, type-specific config, status history, and admin access for the creator. The organization must be active and verified, the subscription must be active, and `repository_limit` must allow another repository. `null` limit is unlimited; `0` means none.

Owner or admin Bearer repository.create application/json

`type` cannot be changed later.
Free plans snapshot `repository_limit = 1`.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Request body fields

Field	Type	Required	Description	Example
name	string	required	Display name. Maximum 191 characters unless noted otherwise.	Magento Private Packages
type	string	required	Resource type. Repository type is composer or npm and cannot change later.	composer
visibility	string	optional	Repository visibility. Default private.	private
description	string	optional	Optional human-readable description.	Private Composer packages

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data.name	string	Display name. Maximum 191 characters unless noted otherwise.	Magento Private Packages
data.slug	string	URL-friendly unique name generated from the display name.	magento-private-packages
data.code	string	Stable machine identifier or usage/entitlement code.	repo_01k5fy9xz7f2k…
data.type	string	Resource type. Repository type is composer or npm and cannot change later.	composer
data.status	string	Lifecycle status for this resource.	active
data.url	url	Protocol or resource URL.	https://repo.repotree.com/r/repo_01k5fy9xz7f2k…

Response 201 example

{
    "data": {
        "uuid": "\u2026",
        "name": "Magento Private Packages",
        "slug": "magento-private-packages",
        "code": "repo_01k5fy9xz7f2k\u2026",
        "type": "composer",
        "status": "active",
        "url": "https://repo.repotree.com/r/repo_01k5fy9xz7f2k\u2026"
    }
}

Request JSON example

{
    "name": "Magento Private Packages",
    "type": "composer",
    "visibility": "private",
    "description": "Private Composer packages"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Magento Private Packages","type":"composer","visibility":"private","description":"Private Composer packages"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"name":"Magento Private Packages","type":"composer","visibility":"private","description":"Private Composer packages"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Magento Private Packages",
    "type": "composer",
    "visibility": "private",
    "description": "Private Composer packages"
}),
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/repositories/{repositoryUuid} Get a repository

Get a repository

Returns one repository identified by UUID, scoped to the organization.

Owner or admin Bearer repository.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

PUT /organizations/{uuid}/repositories/{repositoryUuid} Update a repository

Update a repository

Updates name, slug, description, and visibility. Sending `type` is rejected.

Owner or admin Bearer repository.update application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Request body fields

Field	Type	Required	Description	Example
name	string	required	Display name. Maximum 191 characters unless noted otherwise.	Magento Private Packages
description	string	optional	Optional human-readable description.	Updated

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "name": "Magento Private Packages",
    "description": "Updated"
}

Code examples

curl -X PUT "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Magento Private Packages","description":"Updated"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"name":"Magento Private Packages","description":"Updated"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}', {
  method: 'PUT',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Magento Private Packages",
    "description": "Updated"
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/repositories/{repositoryUuid} Archive a repository

Archive a repository

Sets status to archived. Packages and files are not deleted. Archived repositories do not count toward `repository_limit`.

Owner or admin Bearer repository.archive

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/suspend Suspend a repository

Suspend a repository

Temporarily makes the repository unavailable. Recorded in status history.

Owner or admin Bearer repository.suspend

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/suspend" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/suspend');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/suspend', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/reactivate Reactivate a repository

Reactivate a repository

Returns a suspended repository to active. The organization must be active.

Owner or admin Bearer repository.suspend

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/reactivate" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/reactivate');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/reactivate', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

Repository settings

Allow-listed settings per repository type. Arbitrary keys are rejected.

GET /organizations/{uuid}/repositories/{repositoryUuid}/settings Get settings

Get settings

Returns the allow-listed settings plus Composer/NPM config values.

Owner or admin Bearer repository.settings.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/settings" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/settings');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/settings', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

PUT /organizations/{uuid}/repositories/{repositoryUuid}/settings Update settings

Update settings

Validates keys against the repository driver. Composer: `minimum_stability`, `prefer_stable`. NPM: `default_dist_tag`, `allow_unpublish`.

Owner or admin Bearer repository.settings.manage application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Request body fields

Field	Type	Required	Description	Example
settings.prefer_stable	boolean	optional	Composer prefer-stable flag.	true
settings.minimum_stability	string	optional	Composer minimum stability. Example: stable.	stable

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "settings": {
        "prefer_stable": true,
        "minimum_stability": "stable"
    }
}

Code examples

curl -X PUT "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/settings" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN" \
  -H "Content-Type: application/json" \
  -d '{"settings":{"prefer_stable":true,"minimum_stability":"stable"}}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/settings');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"settings":{"prefer_stable":true,"minimum_stability":"stable"}}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/settings', {
  method: 'PUT',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "settings": {
        "prefer_stable": true,
        "minimum_stability": "stable"
    }
}),
});

const payload = await response.json();
console.log(payload);

Repository domains

Custom domain records only. DNS/SSL provisioning belongs to future Integration/Operation modules.

GET /organizations/{uuid}/repositories/{repositoryUuid}/domains List domains

List domains

Verification tokens are never returned.

Owner or admin Bearer repository.domain.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/domains" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/domains');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/domains', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/domains Add a domain

Add a domain

Domains are globally unique. Counted against the subscription `custom_domain_limit` (`0` means none).

Owner or admin Bearer repository.domain.manage application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Request body fields

Field	Type	Required	Description	Example
domain	string	required	Hostname to attach. Must be a valid domain.	packages.customer.com
is_primary	boolean	optional	Whether this domain is the primary hostname.	true

Response 201 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "domain": "packages.customer.com",
    "is_primary": true
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/domains" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN" \
  -H "Content-Type: application/json" \
  -d '{"domain":"packages.customer.com","is_primary":true}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/domains');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"domain":"packages.customer.com","is_primary":true}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/domains', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "domain": "packages.customer.com",
    "is_primary": true
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/repositories/{repositoryUuid}/domains/{domainUuid} Remove a domain

Remove a domain

Deletes the domain record.

Owner or admin Bearer repository.domain.manage

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
domainUuid	uuid	required	Custom domain public ID.	01a0c9ee-b600-7000-8000-000000000007

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/domains/{domainUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/domains/{domainUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/domains/{domainUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

Repository IP rules

Allow-list of IPv4, IPv6, and CIDR ranges. Empty list means no extra IP restriction. IP rules never replace authentication.

GET /organizations/{uuid}/repositories/{repositoryUuid}/ip-rules List IP rules

List IP rules

Returns allow-list entries.

Owner or admin Bearer repository.ip_whitelist.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/ip-rules" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/ip-rules');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/ip-rules', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/ip-rules Add an IP rule

Add an IP rule

Rejects invalid IPv4/IPv6/CIDR. Counted against `whitelist_ip_limit` (`0` means none).

Owner or admin Bearer repository.ip_whitelist.manage application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Request body fields

Field	Type	Required	Description	Example
ip_range	string	required	IPv4/IPv6 address or CIDR range allowed to access the repository.	203.0.113.0/24
description	string	optional	Optional human-readable description.	Office

Response 201 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "ip_range": "203.0.113.0/24",
    "description": "Office"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/ip-rules" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN" \
  -H "Content-Type: application/json" \
  -d '{"ip_range":"203.0.113.0/24","description":"Office"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/ip-rules');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"ip_range":"203.0.113.0/24","description":"Office"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/ip-rules', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "ip_range": "203.0.113.0/24",
    "description": "Office"
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/repositories/{repositoryUuid}/ip-rules/{ipRuleUuid} Remove an IP rule

Remove an IP rule

Deletes the allow-list entry.

Owner or admin Bearer repository.ip_whitelist.manage

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
ipRuleUuid	string	required	Path parameter `ipRuleUuid`.	{ipRuleUuid}

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/ip-rules/{ipRuleUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/ip-rules/{ipRuleUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/ip-rules/{ipRuleUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

Repository access

Member and access-key assignments. Access keys from another organization are rejected. Secrets are never returned here.

GET /organizations/{uuid}/repositories/{repositoryUuid}/access List access grants

List access grants

Polymorphic grants for members, access keys, integrations, and customers.

Owner or admin Bearer repository.access.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/access Assign access

Assign access

Subjects include `organization_member` (membership id), `access_key`, and `access_token` (token row id). Levels: read, write, admin.

Owner or admin Bearer repository.access.manage application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Request body fields

Field	Type	Required	Description	Example
subject_type	string	required	Who receives repository access: user, member, or access_key.	organization_member
subject_id	integer	required	Internal subject id for the access grant.	12
access_level	string	required	Repository grant level, such as pull or admin.	write

Response 201 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "subject_type": "organization_member",
    "subject_id": 12,
    "access_level": "write"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN" \
  -H "Content-Type: application/json" \
  -d '{"subject_type":"organization_member","subject_id":12,"access_level":"write"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"subject_type":"organization_member","subject_id":12,"access_level":"write"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "subject_type": "organization_member",
    "subject_id": 12,
    "access_level": "write"
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/repositories/{repositoryUuid}/access/{accessUuid} Revoke access

Revoke access

Sets the grant to revoked.

Owner or admin Bearer repository.access.manage

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
accessUuid	string	required	Path parameter `accessUuid`.	{accessUuid}

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access/{accessUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access/{accessUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access/{accessUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/repositories/{repositoryUuid}/access-keys List assigned access keys

List assigned access keys

Returns username and metadata only. Never `secret` or `secret_hash`.

Owner or admin Bearer repository.access.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access-keys" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access-keys');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access-keys', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/access-keys Assign an access key

Assign an access key

The key must belong to the same organization and be active. Assignment is required before Composer/NPM clients can use the key on this repository.

Owner or admin Bearer repository.access.manage application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Request body fields

Field	Type	Required	Description	Example
access_key_uuid	string	optional	Access key uuid	…
access_level	string	required	Repository grant level, such as pull or admin.	read

Response 201 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "access_key_uuid": "\u2026",
    "access_level": "read"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access-keys" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN" \
  -H "Content-Type: application/json" \
  -d '{"access_key_uuid":"…","access_level":"read"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access-keys');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"access_key_uuid":"…","access_level":"read"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access-keys', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "access_key_uuid": "…",
    "access_level": "read"
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/repositories/{repositoryUuid}/access-keys/{assignmentUuid} Revoke an access-key assignment

Revoke an access-key assignment

Removes the assignment. The organization access key itself is unchanged.

Owner or admin Bearer repository.access.manage

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
assignmentUuid	string	required	Path parameter `assignmentUuid`.	{assignmentUuid}

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access-keys/{assignmentUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access-keys/{assignmentUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/access-keys/{assignmentUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

Packages

Composer or NPM packages inside a repository. Package type always matches the repository type.

GET /organizations/{uuid}/repositories/{repositoryUuid}/packages List packages

List packages

Returns packages for the repository in the URL.

Owner, admin, or developer Bearer package.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/packages Create a package

Create a package

Creates a package and its initial source. `source_type` is `manual_upload` or `git`. Raw Git tokens are rejected; use `source.credential_uuid` from the Git credentials vault.

Owner, admin, or developer Bearer package.create application/json

Package type is copied from the repository and cannot be overridden.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Request body fields

Field	Type	Required	Description	Example
name	string	required	Display name. Maximum 191 characters unless noted otherwise.	acme/module-catalog
source_type	string	required	Package source: manual_upload or git.	manual_upload

Response 201 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "name": "acme/module-catalog",
    "source_type": "manual_upload"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER" \
  -H "Content-Type: application/json" \
  -d '{"name":"acme/module-catalog","source_type":"manual_upload"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"name":"acme/module-catalog","source_type":"manual_upload"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "acme/module-catalog",
    "source_type": "manual_upload"
}),
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid} Get a package

Get a package

Returns one package identified by UUID, scoped to the repository.

Owner, admin, or developer Bearer package.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

PUT /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid} Update a package

Update a package

Updates display name and description. Name and type cannot change.

Owner, admin, or developer Bearer package.update application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd

Request body fields

Field	Type	Required	Description	Example
display_name	string	optional	Optional package display name. Package name cannot change after create.	Catalog

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "display_name": "Catalog"
}

Code examples

curl -X PUT "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER" \
  -H "Content-Type: application/json" \
  -d '{"display_name":"Catalog"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"display_name":"Catalog"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}', {
  method: 'PUT',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "display_name": "Catalog"
}),
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/deprecate Deprecate a package

Deprecate a package

Marks the package deprecated. Existing versions stay available.

Owner, admin, or developer Bearer package.update application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd

Request body fields

Field	Type	Required	Description	Example
message	string	optional	Human-readable message, such as a deprecation reason.	Use catalog-next

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "message": "Use catalog-next"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/deprecate" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER" \
  -H "Content-Type: application/json" \
  -d '{"message":"Use catalog-next"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/deprecate');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"message":"Use catalog-next"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/deprecate', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "message": "Use catalog-next"
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid} Archive a package

Archive a package

Archives the package. Published versions are kept.

Owner, admin, or developer Bearer package.archive

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

Package sources

Manual upload or Git. Providers are github, bitbucket, gitlab, generic_git. Secrets are never stored or returned.

GET /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources List sources

List sources

`has_credential` and `credential_uuid` are returned. Secrets and numeric credential ids are never included.

Owner, admin, or developer Bearer package.source.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources Add a source

Add a source

Git sources require provider + repository_url. file://, localhost, and credential-in-URL values are rejected. Attach a vaulted credential with `credential_uuid`.

Owner, admin, or developer Bearer package.source.create application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd

Request body fields

Field	Type	Required	Description	Example
source_type	string	required	Package source: manual_upload or git.	git
provider	string	optional	Git provider: github, bitbucket, gitlab, or generic_git.	github
repository_url	url	optional	Git clone URL. file://, localhost, and credentials in the URL are rejected.	https://github.com/acme/module-catalog.git
package_path	string	optional	Path inside the Git repository. Default .	.
credential_uuid	uuid	optional	Vaulted Git credential. Never send raw tokens in the payload.	…

Response 201 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "source_type": "git",
    "provider": "github",
    "repository_url": "https://github.com/acme/module-catalog.git",
    "package_path": ".",
    "credential_uuid": "\u2026"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER" \
  -H "Content-Type: application/json" \
  -d '{"source_type":"git","provider":"github","repository_url":"https://github.com/acme/module-catalog.git","package_path":".","credential_uuid":"…"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"source_type":"git","provider":"github","repository_url":"https://github.com/acme/module-catalog.git","package_path":".","credential_uuid":"…"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "source_type": "git",
    "provider": "github",
    "repository_url": "https://github.com/acme/module-catalog.git",
    "package_path": ".",
    "credential_uuid": "…"
}),
});

const payload = await response.json();
console.log(payload);

PUT /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid} Rotate credential

Rotate credential

Updates `credential_uuid` only. Published versions are unchanged. Send `null` to detach.

Owner, admin, or developer Bearer package.source.update application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd
sourceUuid	uuid	required	Package source public ID (manual upload or Git).	01a0c9ee-aceb-71a4-b10b-278764d98def

Request body fields

Field	Type	Required	Description	Example
credential_uuid	uuid	optional	Vaulted Git credential. Never send raw tokens in the payload.	…

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "credential_uuid": "\u2026"
}

Code examples

curl -X PUT "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER" \
  -H "Content-Type: application/json" \
  -d '{"credential_uuid":"…"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"credential_uuid":"…"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}', {
  method: 'PUT',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "credential_uuid": "…"
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid} Disconnect a source

Disconnect a source

Does not delete previously published versions.

Owner, admin, or developer Bearer package.source.delete

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd
sourceUuid	uuid	required	Package source public ID (manual upload or Git).	01a0c9ee-aceb-71a4-b10b-278764d98def

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/test Test connection

Test connection

Runs a lightweight Git ls-remote. Does not clone the repository.

Owner, admin, or developer Bearer package.source.test

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd
sourceUuid	uuid	required	Package source public ID (manual upload or Git).	01a0c9ee-aceb-71a4-b10b-278764d98def

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/test" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/test');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/test', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/sync Sync tags

Sync tags

Imports new eligible Git tags. Existing versions are skipped. Moved tags are reported as conflicts.

Owner, admin, or developer Bearer package.source.sync

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd
sourceUuid	uuid	required	Package source public ID (manual upload or Git).	01a0c9ee-aceb-71a4-b10b-278764d98def

Response 202 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/sync" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/sync');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/sync', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/references List remote refs

List remote refs

Returns sanitized branch and tag names.

Owner, admin, or developer Bearer package.source.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd
sourceUuid	uuid	required	Package source public ID (manual upload or Git).	01a0c9ee-aceb-71a4-b10b-278764d98def

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/references" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/references');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/sources/{sourceUuid}/references', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

Package versions

Immutable published artifacts. Manual ZIP/TGZ upload and Git import converge on the same version model.

GET /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions List versions

List versions

Returns versions and source traceability (tag + commit).

Owner, admin, or developer Bearer package.version.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions Publish a manual version

Publish a manual version

Multipart `artifact` plus optional `version`. Composer ZIP or NPM TGZ.

Owner, admin, or developer Bearer package.version.publish multipart/form-data

Use multipart/form-data. `version` is required when composer.json has no version.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	multipart/form-data
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd

Request body fields

Field	Type	Required	Description	Example
artifact	file	required	Composer ZIP or NPM TGZ. Maximum 50 MB. The tester on this page is JSON-only; use curl or a HTTP client for multipart.	package.zip
version	string	optional	Required when composer.json has no version. Ignored when the artifact already declares one.	1.2.0

Response 201 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/import Import from Git

Import from Git

Resolves a tag, branch, or commit, validates metadata, and publishes an immutable artifact.

Owner, admin, or developer Bearer package.version.import application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd

Request body fields

Field	Type	Required	Description	Example
reference_type	string	required	Git reference type: tag or branch.	tag
reference	string	required	Git tag or branch name to import.	v1.2.0

Response 201 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "reference_type": "tag",
    "reference": "v1.2.0"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/import" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER" \
  -H "Content-Type: application/json" \
  -d '{"reference_type":"tag","reference":"v1.2.0"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/import');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"reference_type":"tag","reference":"v1.2.0"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/import', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "reference_type": "tag",
    "reference": "v1.2.0"
}),
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid} Get a version

Get a version

Returns checksums and source snapshot. Storage paths are never returned.

Owner, admin, or developer Bearer package.version.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd
versionUuid	uuid	required	Immutable package version public ID.	01a0c9ee-b001-7000-8000-000000000001

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}/deprecate Deprecate a version

Deprecate a version

Marks the version deprecated without replacing bytes.

Owner, admin, or developer Bearer package.version.deprecate application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd
versionUuid	uuid	required	Immutable package version public ID.	01a0c9ee-b001-7000-8000-000000000001

Request body fields

Field	Type	Required	Description	Example
message	string	optional	Human-readable message, such as a deprecation reason.	Use 1.2.1

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "message": "Use 1.2.1"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}/deprecate" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER" \
  -H "Content-Type: application/json" \
  -d '{"message":"Use 1.2.1"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}/deprecate');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"message":"Use 1.2.1"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}/deprecate', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "message": "Use 1.2.1"
}),
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid} Archive a version

Archive a version

Archives the version. The artifact remains stored.

Owner, admin, or developer Bearer package.version.archive

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd
versionUuid	uuid	required	Immutable package version public ID.	01a0c9ee-b001-7000-8000-000000000001

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

NPM dist-tags

Maps tags such as latest to a package version. Composer packages do not use dist-tags.

GET /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/dist-tags List dist-tags

List dist-tags

Returns tag to version mappings.

Owner, admin, or developer Bearer package.dist_tag.manage

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/dist-tags" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/dist-tags');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/dist-tags', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/dist-tags Set a dist-tag

Set a dist-tag

Points a tag at an existing version UUID.

Owner, admin, or developer Bearer package.dist_tag.manage application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd

Request body fields

Field	Type	Required	Description	Example
tag	string	required	NPM dist-tag name.	latest
version_uuid	uuid	required	Package version to point the dist-tag at.	…

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "tag": "latest",
    "version_uuid": "\u2026"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/dist-tags" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER" \
  -H "Content-Type: application/json" \
  -d '{"tag":"latest","version_uuid":"…"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/dist-tags');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"tag":"latest","version_uuid":"…"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/dist-tags', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "tag": "latest",
    "version_uuid": "…"
}),
});

const payload = await response.json();
console.log(payload);

Authentication

Organization user login, password reset, and the current access context. Composer and NPM use the same Bearer tokens.

POST /auth/login Sign in

Sign in

Authenticates with email and password. Only active users can sign in. Optional `organization_uuid` also requires an active membership in that tenant.

None No permission check application/json

Rate limited per IP + email. Passwords are never logged or returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json

Request body fields

Field	Type	Required	Description	Example
email	email	optional	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]
password	string	required	Account password. Never logged or returned. Reset requires at least 12 characters.	your-password
organization_uuid	uuid	optional	When set, login also requires an active membership in that organization.	…

Response fields

Field	Type	Description	Example
authenticated	boolean	Whether the request resolved an authenticated user or token.	true
user.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
user.email	email	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]

Response 200 example

{
    "authenticated": true,
    "user": {
        "uuid": "\u2026",
        "email": "[email protected]"
    }
}

Request JSON example

{
    "email": "[email protected]",
    "password": "your-password",
    "organization_uuid": "\u2026"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/auth/login" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"your-password","organization_uuid":"…"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/auth/login');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"email":"[email protected]","password":"your-password","organization_uuid":"…"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/auth/login', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "email": "[email protected]",
    "password": "your-password",
    "organization_uuid": "…"
}),
});

const payload = await response.json();
console.log(payload);

POST /auth/logout Sign out

Sign out

Clears the application session when one exists.

Bearer token or session No permission check

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/auth/logout" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/auth/logout');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/auth/logout', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /auth/me Current context

Current context

Returns the authenticated user and, for Bearer tokens, the token UUID and type. Repository and integration tokens may have no user.

Bearer token or session No permission check

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response fields

Field	Type	Description	Example
authenticated	boolean	Whether the request resolved an authenticated user or token.	true
user.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	01a0c9ee-a43a-705e-bcd0-f837f7d2103a
user.email	email	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]
organization	string	Organization	null
token	string	One-time secret. Password reset token, or rt_live_ value returned only on create/rotate.	null

Response 200 example

{
    "authenticated": true,
    "user": {
        "uuid": "01a0c9ee-a43a-705e-bcd0-f837f7d2103a",
        "email": "[email protected]"
    },
    "organization": null,
    "token": null
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/auth/me" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/auth/me');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/auth/me', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

POST /auth/forgot-password Request password reset

Request password reset

Always returns the same message. Sends a hashed one-time token when the email exists.

None No permission check application/json

Rate limited per IP + email.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json

Request body fields

Field	Type	Required	Description	Example
email	email	optional	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "email": "[email protected]"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/auth/forgot-password" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/auth/forgot-password');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"email":"[email protected]"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/auth/forgot-password', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "email": "[email protected]"
}),
});

const payload = await response.json();
console.log(payload);

POST /auth/reset-password Reset password

Reset password

Consumes the reset token and hashes the new password.

None No permission check application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json

Request body fields

Field	Type	Required	Description	Example
email	email	optional	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]
token	string	optional	One-time secret. Password reset token, or rt_live_ value returned only on create/rotate.	…
password	string	required	Account password. Never logged or returned. Reset requires at least 12 characters.	new-password-12
password_confirmation	string	required	Must match password.	new-password-12

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "email": "[email protected]",
    "token": "\u2026",
    "password": "new-password-12",
    "password_confirmation": "new-password-12"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/auth/reset-password" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","token":"…","password":"new-password-12","password_confirmation":"new-password-12"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/auth/reset-password');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"email":"[email protected]","token":"…","password":"new-password-12","password_confirmation":"new-password-12"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/auth/reset-password', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "email": "[email protected]",
    "token": "…",
    "password": "new-password-12",
    "password_confirmation": "new-password-12"
}),
});

const payload = await response.json();
console.log(payload);

POST /auth/change-password Change password

Change password

Requires the current password. Invalidates remember tokens.

Authenticated member No permission check application/json

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Request body fields

Field	Type	Required	Description	Example
current_password	string	required	Current password. Required to change password.	your-password
password	string	required	Account password. Never logged or returned. Reset requires at least 12 characters.	changed-password-12
password_confirmation	string	required	Must match password.	changed-password-12

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "current_password": "your-password",
    "password": "changed-password-12",
    "password_confirmation": "changed-password-12"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/auth/change-password" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d '{"current_password":"your-password","password":"changed-password-12","password_confirmation":"changed-password-12"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/auth/change-password');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"current_password":"your-password","password":"changed-password-12","password_confirmation":"changed-password-12"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/auth/change-password', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "current_password": "your-password",
    "password": "changed-password-12",
    "password_confirmation": "changed-password-12"
}),
});

const payload = await response.json();
console.log(payload);

Access tokens

Hashed `rt_live_` Bearer tokens for users, admins, repositories, and integrations. HTTP Basic username `token` plus the secret is also accepted. Query-string tokens are rejected.

GET /organizations/{uuid}/access-tokens List tokens

List tokens

Never includes `token_hash` or the full secret.

Owner Bearer access_token.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/access-tokens Create a token

Create a token

Returns `token` once. Store it immediately.

Owner Bearer access_token.create application/json

Types: user, admin, repository, integration. User and admin tokens are tied to a member. Repository and integration tokens can omit a user and then need an explicit repository grant to download.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Request body fields

Field	Type	Required	Description	Example
name	string	required	Display name. Maximum 191 characters unless noted otherwise.	Production Composer
token_type	string	required	Access token type: user, admin, repository, or integration. User and admin tokens require a member. Repository and integration tokens may omit a user.	repository

Response fields

Field	Type	Description	Example
data.uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	…
data.token_prefix	string	Public prefix of a hashed token. The full secret cannot be recovered.	rt_live_abcd1234
data.token_type	string	Access token type: user, admin, repository, or integration. User and admin tokens require a member. Repository and integration tokens may omit a user.	repository
token	string	One-time secret. Password reset token, or rt_live_ value returned only on create/rotate.	rt_live_…

Response 201 example

{
    "data": {
        "uuid": "\u2026",
        "token_prefix": "rt_live_abcd1234",
        "token_type": "repository"
    },
    "token": "rt_live_\u2026"
}

Request JSON example

{
    "name": "Production Composer",
    "token_type": "repository"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER" \
  -H "Content-Type: application/json" \
  -d '{"name":"Production Composer","token_type":"repository"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"name":"Production Composer","token_type":"repository"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Production Composer",
    "token_type": "repository"
}),
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/access-tokens/{tokenUuid} Get a token

Get a token

Metadata only. The secret cannot be recovered.

Owner Bearer access_token.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
tokenUuid	uuid	required	Access token public ID. The full rt_live_ secret is returned only on create and rotate.	01a0c9ee-b500-7000-8000-000000000006

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens/{tokenUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens/{tokenUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens/{tokenUuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/access-tokens/{tokenUuid}/revoke Revoke a token

Revoke a token

Sets status to revoked. Authentication fails immediately.

Owner Bearer access_token.revoke

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
tokenUuid	uuid	required	Access token public ID. The full rt_live_ secret is returned only on create and rotate.	01a0c9ee-b500-7000-8000-000000000006

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens/{tokenUuid}/revoke" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens/{tokenUuid}/revoke');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens/{tokenUuid}/revoke', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/access-tokens/{tokenUuid}/rotate Rotate a token

Rotate a token

Creates a new hashed token and revokes the previous row. The new secret is returned once.

Owner Bearer access_token.rotate

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
tokenUuid	uuid	required	Access token public ID. The full rt_live_ secret is returned only on create and rotate.	01a0c9ee-b500-7000-8000-000000000006

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens/{tokenUuid}/rotate" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens/{tokenUuid}/rotate');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/access-tokens/{tokenUuid}/rotate', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/authentication-logs Authentication logs

Authentication logs

Login, token, and repository-denial events. Secrets are never stored.

Owner Bearer authentication_log.view

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/authentication-logs" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/authentication-logs');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/authentication-logs', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/repositories/{repositoryUuid}/authorize Authorize repository access

Authorize repository access

Owner-only management check. Composer/NPM protocol downloads still use repository grants on the protocol URLs.

Owner Bearer repository.download

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner Bearer `rt_live_…` only. Organization credentials and non-owner members are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/authorize" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/authorize');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/authorize', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER',
  },
});

const payload = await response.json();
console.log(payload);

Downloads

Owner, admin, or developer artifact delivery and history. Composer/NPM protocol clients may also use a repository token with a Read grant on the stream URLs. Artifacts are streamed through the application; raw storage URLs are never returned.

GET /organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}/download Download a version artifact

Download a version artifact

Streams the primary artifact. Requires an active organization and an available storage object. HEAD is supported and does not create a download record.

Owner, admin, or developer Bearer repository.download

Cache-Control is private, no-store.
Query-string tokens are rejected.
Composer/NPM clients may also authenticate with a repository token that has a Read grant.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
packageUuid	uuid	required	Package public ID, scoped to the repository.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd
versionUuid	uuid	required	Immutable package version public ID.	01a0c9ee-b001-7000-8000-000000000001

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}/download" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}/download');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/packages/{packageUuid}/versions/{versionUuid}/download', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/repositories/{repositoryUuid}/artifacts/{artifactUuid}/download Download an artifact

Download an artifact

Same delivery pipeline as version download. The artifact must belong to the repository in the URL.

Owner, admin, or developer Bearer repository.download

Do not pass storage_object_id.
Composer/NPM clients may also authenticate with a repository token that has a Read grant.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
repositoryUuid	uuid	required	Repository public ID (UUIDv7), scoped to the organization in the URL.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
artifactUuid	uuid	required	Artifact public ID. Clients never pass storage object IDs or object keys.	01a0c9ee-b100-7000-8000-000000000002

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/artifacts/{artifactUuid}/download" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/artifacts/{artifactUuid}/download');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/repositories/{repositoryUuid}/artifacts/{artifactUuid}/download', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/downloads List downloads

List downloads

Paginated delivery history. Filters: status, download_type, repository, package, version, organization_user, date_from, date_to.

Owner, admin, or developer Bearer download.view

Organization credentials and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
status	string	optional	Delivery status.	completed
download_type	string	optional	How the artifact was requested.	composer
repository	uuid	optional	Repository UUID filter.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
package	uuid	optional	Package UUID filter.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd
version	uuid	optional	Version UUID filter.	01a0c9ee-b001-7000-8000-000000000001
date_from	datetime	optional	Inclusive start.	2026-09-01T00:00:00Z
date_to	datetime	optional	Inclusive end.	2026-09-22T23:59:59Z
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/downloads" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/downloads');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/downloads', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/downloads/{downloadUuid} Get a download

Get a download

Metadata only. Storage keys, buckets, and tokens are omitted.

Owner, admin, or developer Bearer download.view

Organization credentials and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
downloadUuid	uuid	required	One artifact delivery attempt. History APIs never return storage paths.	01a0c9ee-b200-7000-8000-000000000003

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/downloads/{downloadUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/downloads/{downloadUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/downloads/{downloadUuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

Usage & entitlements

Owner or admin usage and entitlement read APIs. Usage is consumed. Entitlement is allowed. Plan catalog plus organization overrides. Organization users cannot change plan limits.

GET /organizations/{uuid}/usage List usage

List usage

Current consumption vs effective limits for storage, downloads, users, repositories, packages, and domains.

Owner or admin Bearer usage.view

Tenant isolation is mandatory. Plan mutations are admin-only.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response fields

Field	Type	Description	Example
data[].code	string	Stable machine identifier or usage/entitlement code.	storage.bytes
data[].used	integer	Current consumption for this entitlement.	1048576
data[].limit	integer	Effective numeric limit. Null means unlimited.	1073741824
data[].remaining	integer	Remaining numeric capacity.	1072693248
data[].over_limit	boolean	Whether current usage exceeds the effective limit.	false

Response 200 example

{
    "data": [
        {
            "code": "storage.bytes",
            "used": 1048576,
            "limit": 1073741824,
            "remaining": 1072693248,
            "over_limit": false
        }
    ]
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/usage" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/usage');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/usage', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/usage/{code} Get a usage metric

Get a usage metric

One usage code. download.count maps onto the monthly download entitlement.

Owner or admin Bearer usage.view

Tenant isolation is mandatory. Plan mutations are admin-only.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
code	string	required	Usage or entitlement code such as storage.bytes or repositories.count.	storage.bytes

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/usage/{code}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/usage/{code}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/usage/{code}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/usage/history Usage events

Usage events

Paginated idempotent usage events. Does not expose storage keys or tokens.

Owner or admin Bearer usage.view

Tenant isolation is mandatory. Plan mutations are admin-only.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
code	string	optional	Usage metric code.	download.bytes
date_from	datetime	optional	Inclusive start.	2026-09-01T00:00:00Z
date_to	datetime	optional	Inclusive end.	2026-09-22T23:59:59Z
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/usage/history" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/usage/history');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/usage/history', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/usage/snapshots Usage snapshots

Usage snapshots

Historical snapshots for reporting. Not used for live authorization.

Owner or admin Bearer usage.view

Tenant isolation is mandatory. Plan mutations are admin-only.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/usage/snapshots" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/usage/snapshots');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/usage/snapshots', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/entitlements List entitlements

List entitlements

Effective entitlements (plan + active override). Unlimited is a type, not a large number.

Owner or admin Bearer usage.view

Tenant isolation is mandatory. Plan mutations are admin-only.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response fields

Field	Type	Description	Example
data[].code	string	Stable machine identifier or usage/entitlement code.	repository_limit
data[].type	string	Resource type. Repository type is composer or npm and cannot change later.	numeric
data[].value	integer	Entitlement value. Unlimited is a type, not a large number.	1
data[].used	integer	Current consumption for this entitlement.	1
data[].remaining	integer	Remaining numeric capacity.	0
data[].over_limit	boolean	Whether current usage exceeds the effective limit.	false

Response 200 example

{
    "data": [
        {
            "code": "repository_limit",
            "type": "numeric",
            "value": 1,
            "used": 1,
            "remaining": 0,
            "over_limit": false
        }
    ]
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/entitlements" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/entitlements');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/entitlements', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/entitlements/{code} Get an entitlement

Get an entitlement

Includes used, remaining, and over_limit for numeric limits.

Owner or admin Bearer usage.view

Tenant isolation is mandatory. Plan mutations are admin-only.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
code	string	required	Usage or entitlement code such as storage.bytes or repositories.count.	storage.bytes

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/entitlements/{code}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/entitlements/{code}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/entitlements/{code}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

Operations

Owner or admin tracking, cancel, and retry for long-running organization work. Creation happens through business modules such as repository sync or usage recalculation.

GET /organizations/{uuid}/operations List operations

List operations

Paginated, newest first. Filter by status, type, priority, repository, package, and created_from/created_to. Default 20, maximum 100.

Owner or admin Bearer operation.view

Tenant isolation is mandatory. Operation creation is not a public generic API.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
status	string	optional	pending, queued, running, succeeded, failed, cancelled.	running
type	string	optional	Business operation type.	package.sync
priority	string	optional	Queue priority.	normal
repository	uuid	optional	Repository UUID filter.	01a0c9ee-abb0-7137-8411-17511d7ebb2a
package	uuid	optional	Package UUID filter.	01a0c9ee-acd1-7366-93c2-a26c8e1d2bdd
created_from	datetime	optional	Created after this timestamp.	2026-09-01T00:00:00Z
created_to	datetime	optional	Created before this timestamp.	2026-09-22T23:59:59Z
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response fields

Field	Type	Description	Example
data[].uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	01a0c9ee-b900-7000-8000-00000000000a
data[].type	string	Resource type. Repository type is composer or npm and cannot change later.	package.sync
data[].status	string	Lifecycle status for this resource.	running
data[].progress	integer	Operation progress percent, 0–100.	40

Response 200 example

{
    "data": [
        {
            "uuid": "01a0c9ee-b900-7000-8000-00000000000a",
            "type": "package.sync",
            "status": "running",
            "progress": 40
        }
    ]
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/operations" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/operations');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/operations', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/operations/{operationUuid} Get an operation

Get an operation

Progress, result, and customer-safe errors. Does not expose worker_job_id, stack traces, or credentials.

Owner or admin Bearer operation.view

Tenant isolation is mandatory. Operation creation is not a public generic API.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
operationUuid	uuid	required	Background operation public ID. Laravel job IDs are never customer-facing.	01a0c9ee-b900-7000-8000-00000000000a

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/operations/{operationUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/operations/{operationUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/operations/{operationUuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/operations/{operationUuid}/cancel Cancel an operation

Cancel an operation

Immediate for pending/queued work. Running work is cooperatively cancelled at the next handler checkpoint.

Owner or admin Bearer operation.cancel

Tenant isolation is mandatory. Operation creation is not a public generic API.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
operationUuid	uuid	required	Background operation public ID. Laravel job IDs are never customer-facing.	01a0c9ee-b900-7000-8000-00000000000a

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/operations/{operationUuid}/cancel" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/operations/{operationUuid}/cancel');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/operations/{operationUuid}/cancel', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/operations/{operationUuid}/retry Retry a failed operation

Retry a failed operation

Only failed operations. Requeues the same UUID; does not create a duplicate.

Owner or admin Bearer operation.retry

Tenant isolation is mandatory. Operation creation is not a public generic API.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
operationUuid	uuid	required	Background operation public ID. Laravel job IDs are never customer-facing.	01a0c9ee-b900-7000-8000-00000000000a

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/operations/{operationUuid}/retry" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/operations/{operationUuid}/retry');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/operations/{operationUuid}/retry', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

Repository protocol

Composer and NPM metadata for private repositories. Owner, admin, and developer can read it. Dist and tarball URLs point at the Download API. Metadata requests are not counted as package downloads.

GET /r/{repositoryCode}/packages.json Composer packages.json

Composer packages.json

Composer 2 repository root. Includes available-packages, metadata-url, and published package versions. Dist URLs never expose storage paths.

Owner, admin, or developer Bearer repository.metadata

Requires an active Composer repository.
ETag / If-None-Match are supported.
Composer/NPM clients may also authenticate with a repository token that has a Read grant (Bearer or HTTP Basic). That is the consumer path for later customer downloads.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
repositoryCode	string	required	Stable machine identifier (`repo_…`) used in Composer and NPM protocol URLs.	repo_01m34yxaxcshdfz93ag2fj237f

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "https://repo.repotree.com/r/{repositoryCode}/packages.json" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('https://repo.repotree.com/r/{repositoryCode}/packages.json');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('https://repo.repotree.com/r/{repositoryCode}/packages.json', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

GET /r/{repositoryCode}/p2/{vendor}/{package}.json Composer package metadata

Composer package metadata

Composer 2 minified package metadata for one vendor/package name.

Owner, admin, or developer Bearer repository.metadata

Composer/NPM clients may also authenticate with a repository token that has a Read grant (Bearer or HTTP Basic). That is the consumer path for later customer downloads.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
repositoryCode	string	required	Stable machine identifier (`repo_…`) used in Composer and NPM protocol URLs.	repo_01m34yxaxcshdfz93ag2fj237f
vendor	string	required	Composer vendor segment of the package name.	acme
package	string	required	Composer package name or NPM package name.	module-catalog

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "https://repo.repotree.com/r/{repositoryCode}/p2/{vendor}/{package}.json" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('https://repo.repotree.com/r/{repositoryCode}/p2/{vendor}/{package}.json');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('https://repo.repotree.com/r/{repositoryCode}/p2/{vendor}/{package}.json', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

GET /npm/{repositoryCode}/{package} NPM package metadata

NPM package metadata

Unscoped NPM packument. dist.tarball uses the authorized download endpoint.

Owner, admin, or developer Bearer repository.metadata

Composer/NPM clients may also authenticate with a repository token that has a Read grant (Bearer or HTTP Basic). That is the consumer path for later customer downloads.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
repositoryCode	string	required	Stable machine identifier (`repo_…`) used in Composer and NPM protocol URLs.	repo_01m34yxaxcshdfz93ag2fj237f
package	string	required	Composer package name or NPM package name.	module-catalog

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "https://repo.repotree.com/npm/{repositoryCode}/{package}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('https://repo.repotree.com/npm/{repositoryCode}/{package}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('https://repo.repotree.com/npm/{repositoryCode}/{package}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

GET /npm/{repositoryCode}/@{scope}/{package} Scoped NPM package metadata

Scoped NPM package metadata

Scoped packument for @scope/package. Do not flatten the @scope segment.

Owner, admin, or developer Bearer repository.metadata

Composer/NPM clients may also authenticate with a repository token that has a Read grant (Bearer or HTTP Basic). That is the consumer path for later customer downloads.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner, admin, or developer Bearer `rt_live_…` only. Organization credentials and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
repositoryCode	string	required	Stable machine identifier (`repo_…`) used in Composer and NPM protocol URLs.	repo_01m34yxaxcshdfz93ag2fj237f
scope	string	required	NPM scope without the leading @.	acme
package	string	required	Composer package name or NPM package name.	module-catalog

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "https://repo.repotree.com/npm/{repositoryCode}/@{scope}/{package}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER"

<?php

$ch = curl_init('https://repo.repotree.com/npm/{repositoryCode}/@{scope}/{package}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('https://repo.repotree.com/npm/{repositoryCode}/@{scope}/{package}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_ADMIN_OR_DEVELOPER',
  },
});

const payload = await response.json();
console.log(payload);

Integration API

Versioned Billing ↔ Repository synchronization. Authenticates an integration, not a customer user. Business rules stay in Organization, Repository, Package, and Entitlement modules.

POST /api/integration/v1/organizations Synchronize an organization

Synchronize an organization

Creates or returns the mapped organization. Free plans do not require a payment reference. Send Idempotency-Key for retries.

Integration Bearer token (rt_int_) organization.write

Responses use {success, data} or {success:false, error:{code,message}, request_id}.
X-Request-ID is preserved when valid, otherwise generated.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 201 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/integration/v1/organizations" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_int_YOUR_TOKEN" \
  -H "Idempotency-Key: 7f6f-example"

<?php

$ch = curl_init('http://api1.truerepos.com/api/integration/v1/organizations');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_int_YOUR_TOKEN',
        'Idempotency-Key: 7f6f-example',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/integration/v1/organizations', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_int_YOUR_TOKEN',
    'Idempotency-Key': '7f6f-example',
  },
});

const payload = await response.json();
console.log(payload);

GET /api/integration/v1/organizations/{uuid} Get an organization

Get an organization

Tenant isolation applies to organization-scoped integrations. System-level billing credentials may read any organization.

Integration Bearer token (rt_int_) organization.read

Responses use {success, data} or {success:false, error:{code,message}, request_id}.
X-Request-ID is preserved when valid, otherwise generated.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/integration/v1/organizations/{uuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_int_YOUR_TOKEN" \
  -H "Idempotency-Key: 7f6f-example"

<?php

$ch = curl_init('http://api1.truerepos.com/api/integration/v1/organizations/{uuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_int_YOUR_TOKEN',
        'Idempotency-Key: 7f6f-example',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/integration/v1/organizations/{uuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_int_YOUR_TOKEN',
    'Idempotency-Key': '7f6f-example',
  },
});

const payload = await response.json();
console.log(payload);

PATCH /api/integration/v1/organizations/{uuid} Update organization status or plan

Update organization status or plan

Delegates verify, suspend, reactivate, close, and plan assignment to the Organization module.

Integration Bearer token (rt_int_) organization.write

Responses use {success, data} or {success:false, error:{code,message}, request_id}.
X-Request-ID is preserved when valid, otherwise generated.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X PATCH "http://api1.truerepos.com/api/integration/v1/organizations/{uuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_int_YOUR_TOKEN" \
  -H "Idempotency-Key: 7f6f-example"

<?php

$ch = curl_init('http://api1.truerepos.com/api/integration/v1/organizations/{uuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_int_YOUR_TOKEN',
        'Idempotency-Key: 7f6f-example',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/integration/v1/organizations/{uuid}', {
  method: 'PATCH',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_int_YOUR_TOKEN',
    'Idempotency-Key': '7f6f-example',
  },
});

const payload = await response.json();
console.log(payload);

POST /api/integration/v1/organizations/{uuid}/repositories Synchronize a repository

Synchronize a repository

Creates a Composer or NPM repository for the organization. External IDs are mapped per integration.

Integration Bearer token (rt_int_) repository.write

Responses use {success, data} or {success:false, error:{code,message}, request_id}.
X-Request-ID is preserved when valid, otherwise generated.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Response 201 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/integration/v1/organizations/{uuid}/repositories" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_int_YOUR_TOKEN" \
  -H "Idempotency-Key: 7f6f-example"

<?php

$ch = curl_init('http://api1.truerepos.com/api/integration/v1/organizations/{uuid}/repositories');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_int_YOUR_TOKEN',
        'Idempotency-Key: 7f6f-example',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/integration/v1/organizations/{uuid}/repositories', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_int_YOUR_TOKEN',
    'Idempotency-Key': '7f6f-example',
  },
});

const payload = await response.json();
console.log(payload);

GET /api/integration/v1/repositories/{uuid} Get a repository

Get a repository

Returns public identifiers only. Dist and storage paths are never exposed.

Integration Bearer token (rt_int_) repository.read

Responses use {success, data} or {success:false, error:{code,message}, request_id}.
X-Request-ID is preserved when valid, otherwise generated.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/integration/v1/repositories/{uuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_int_YOUR_TOKEN" \
  -H "Idempotency-Key: 7f6f-example"

<?php

$ch = curl_init('http://api1.truerepos.com/api/integration/v1/repositories/{uuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_int_YOUR_TOKEN',
        'Idempotency-Key: 7f6f-example',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/integration/v1/repositories/{uuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_int_YOUR_TOKEN',
    'Idempotency-Key': '7f6f-example',
  },
});

const payload = await response.json();
console.log(payload);

PATCH /api/integration/v1/repositories/{uuid} Update or archive a repository

Update or archive a repository

status=archived or status=deleted archives through the Repository module.

Integration Bearer token (rt_int_) repository.write

Responses use {success, data} or {success:false, error:{code,message}, request_id}.
X-Request-ID is preserved when valid, otherwise generated.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X PATCH "http://api1.truerepos.com/api/integration/v1/repositories/{uuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_int_YOUR_TOKEN" \
  -H "Idempotency-Key: 7f6f-example"

<?php

$ch = curl_init('http://api1.truerepos.com/api/integration/v1/repositories/{uuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_int_YOUR_TOKEN',
        'Idempotency-Key: 7f6f-example',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/integration/v1/repositories/{uuid}', {
  method: 'PATCH',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_int_YOUR_TOKEN',
    'Idempotency-Key': '7f6f-example',
  },
});

const payload = await response.json();
console.log(payload);

POST /api/integration/v1/repositories/{uuid}/packages Synchronize a package

Synchronize a package

Creates a package shell. Billing defaults omit package.delete.

Integration Bearer token (rt_int_) package.write

Responses use {success, data} or {success:false, error:{code,message}, request_id}.
X-Request-ID is preserved when valid, otherwise generated.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Response 201 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/integration/v1/repositories/{uuid}/packages" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_int_YOUR_TOKEN" \
  -H "Idempotency-Key: 7f6f-example"

<?php

$ch = curl_init('http://api1.truerepos.com/api/integration/v1/repositories/{uuid}/packages');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_int_YOUR_TOKEN',
        'Idempotency-Key: 7f6f-example',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/integration/v1/repositories/{uuid}/packages', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_int_YOUR_TOKEN',
    'Idempotency-Key': '7f6f-example',
  },
});

const payload = await response.json();
console.log(payload);

POST /api/integration/v1/hooks Receive a signed webhook

Receive a signed webhook

Verifies X-RepoTree-Signature (t=,v1= HMAC-SHA256) before recording the event. Invalid signatures are rejected.

Integration Bearer token (rt_int_) webhook.verify

Responses use {success, data} or {success:false, error:{code,message}, request_id}.
X-Request-ID is preserved when valid, otherwise generated.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 202 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/integration/v1/hooks" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_int_YOUR_TOKEN" \
  -H "Idempotency-Key: 7f6f-example"

<?php

$ch = curl_init('http://api1.truerepos.com/api/integration/v1/hooks');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_int_YOUR_TOKEN',
        'Idempotency-Key: 7f6f-example',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/integration/v1/hooks', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_int_YOUR_TOKEN',
    'Idempotency-Key': '7f6f-example',
  },
});

const payload = await response.json();
console.log(payload);

Custom domains

Owner or admin hostnames that resolve Composer and NPM to the same repositories as the default RepoTree host. Entitlement decides eligibility. Access, downloads, and usage stay in their modules.

GET /organizations/{uuid}/custom-domains List custom domains

List custom domains

Returns organization hostnames, DNS instructions, and lifecycle status. Removed domains are omitted.

Owner or admin Bearer custom_domain.view

Unknown protocol hosts return 404. Cross-organization routing returns 403.
Verification tokens are encrypted at rest. Audit events do not store the raw token.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/custom-domains Add a custom domain

Add a custom domain

Normalizes the hostname, checks Entitlement, and returns TXT verification plus CNAME routing records. Limits come from `feature.custom_domain` and `custom_domains.count`.

Owner or admin Bearer custom_domain.manage application/json

Unknown protocol hosts return 404. Cross-organization routing returns 403.
Verification tokens are encrypted at rest. Audit events do not store the raw token.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Request body fields

Field	Type	Required	Description	Example
domain	string	required	Hostname to attach. Must be a valid domain.	packages.customer.com

Response 201 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "domain": "packages.customer.com"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN" \
  -H "Content-Type: application/json" \
  -d '{"domain":"packages.customer.com"}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"domain":"packages.customer.com"}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "domain": "packages.customer.com"
}),
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/custom-domains/{domainUuid} Get a custom domain

Get a custom domain

Returns one hostname scoped to the organization.

Owner or admin Bearer custom_domain.view

Unknown protocol hosts return 404. Cross-organization routing returns 403.
Verification tokens are encrypted at rest. Audit events do not store the raw token.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
domainUuid	uuid	required	Custom domain public ID.	01a0c9ee-b600-7000-8000-000000000007

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/custom-domains/{domainUuid}/verify Verify DNS

Verify DNS

Looks up the TXT record server-side. Does not trust client-supplied DNS data.

Owner or admin Bearer custom_domain.manage

Unknown protocol hosts return 404. Cross-organization routing returns 403.
Verification tokens are encrypted at rest. Audit events do not store the raw token.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
domainUuid	uuid	required	Custom domain public ID.	01a0c9ee-b600-7000-8000-000000000007

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}/verify" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}/verify');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}/verify', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/custom-domains/{domainUuid}/activate Activate a verified domain

Activate a verified domain

Marks the hostname as routable after ownership verification. SSL is tracked; certificates are provisioned by the edge proxy.

Owner or admin Bearer custom_domain.manage

Unknown protocol hosts return 404. Cross-organization routing returns 403.
Verification tokens are encrypted at rest. Audit events do not store the raw token.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
domainUuid	uuid	required	Custom domain public ID.	01a0c9ee-b600-7000-8000-000000000007

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}/activate" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}/activate');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}/activate', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

PATCH /organizations/{uuid}/custom-domains/{domainUuid} Update a custom domain

Update a custom domain

Supports `is_primary`. Only one active domain per organization can be primary.

Owner or admin Bearer custom_domain.manage application/json

Unknown protocol hosts return 404. Cross-organization routing returns 403.
Verification tokens are encrypted at rest. Audit events do not store the raw token.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
domainUuid	uuid	required	Custom domain public ID.	01a0c9ee-b600-7000-8000-000000000007

Request body fields

Field	Type	Required	Description	Example
is_primary	boolean	optional	Whether this domain is the primary hostname.	true

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "is_primary": true
}

Code examples

curl -X PATCH "http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN" \
  -H "Content-Type: application/json" \
  -d '{"is_primary":true}'

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"is_primary":true}',
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}', {
  method: 'PATCH',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "is_primary": true
}),
});

const payload = await response.json();
console.log(payload);

POST /organizations/{uuid}/custom-domains/{domainUuid}/set-primary Set the primary domain

Set the primary domain

Clears the previous primary in the same transaction.

Owner or admin Bearer custom_domain.manage

Unknown protocol hosts return 404. Cross-organization routing returns 403.
Verification tokens are encrypted at rest. Audit events do not store the raw token.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
domainUuid	uuid	required	Custom domain public ID.	01a0c9ee-b600-7000-8000-000000000007

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}/set-primary" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}/set-primary');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}/set-primary', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

DELETE /organizations/{uuid}/custom-domains/{domainUuid} Remove a custom domain

Remove a custom domain

Stops routing. Repositories, packages, and artifacts are not deleted. The hostname may be reused after removal.

Owner or admin Bearer custom_domain.manage

Unknown protocol hosts return 404. Cross-organization routing returns 403.
Verification tokens are encrypted at rest. Audit events do not store the raw token.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
domainUuid	uuid	required	Custom domain public ID.	01a0c9ee-b600-7000-8000-000000000007

Response 204 example

Empty body, or a live payload from the tester.

Code examples

curl -X DELETE "http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/custom-domains/{domainUuid}', {
  method: 'DELETE',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

Audit logs

Owner or admin organization-scoped security and accountability events. Usage metrics and application diagnostics are not duplicated here. Records cannot be updated or deleted through the API.

GET /organizations/{uuid}/audit-logs List audit logs

List audit logs

Paginated newest-first. Filter by event, action, actor_type, resource_type, status, source, date_from, date_to, or q (actor email, resource name, request ID). Max 100 per page.

Owner or admin Bearer audit.view

The organisation is taken from the URL and the authenticated membership. organisation_id query parameters are ignored.
Passwords, tokens, and secrets are stored as [REDACTED] or omitted.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Query parameters

Field	Type	Required	Description	Example
event	string	optional	Audit event name.	member.invited
action	string	optional	Audit action.	create
actor_type	string	optional	Who performed the action.	user
resource_type	string	optional	Affected resource type.	repository
status	string	optional	Outcome status.	success
source	string	optional	Request source.	api
date_from	datetime	optional	Inclusive start (ISO 8601).	2026-09-01T00:00:00Z
date_to	datetime	optional	Inclusive end (ISO 8601).	2026-09-22T23:59:59Z
q	string	optional	Search actor email, resource name, or request ID.	[email protected]
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response fields

Field	Type	Description	Example
data[].uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	01a0c9ee-b700-7000-8000-000000000008
data[].event	string	Audit event name.	member.invited
data[].action	string	Audit action.	create
data[].status	string	Lifecycle status for this resource.	success
data[].actor_email	email	Email of the actor who performed the auditable action.	[email protected]

Response 200 example

{
    "data": [
        {
            "uuid": "01a0c9ee-b700-7000-8000-000000000008",
            "event": "member.invited",
            "action": "create",
            "status": "success",
            "actor_email": "[email protected]"
        }
    ]
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/audit-logs" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/audit-logs');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/audit-logs', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

GET /organizations/{uuid}/audit-logs/{auditUuid} Get an audit record

Get an audit record

Returns actor, resource, status, request context, and sanitized before/after changes. Cross-organization UUIDs 404.

Owner or admin Bearer audit.view

The organisation is taken from the URL and the authenticated membership. organisation_id query parameters are ignored.
Passwords, tokens, and secrets are stored as [REDACTED] or omitted.
Organization credentials, developers, and viewers are rejected.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312
auditUuid	uuid	required	Audit log public ID. Records cannot be updated or deleted.	01a0c9ee-b700-7000-8000-000000000008

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/organizations/{uuid}/audit-logs/{auditUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/organizations/{uuid}/audit-logs/{auditUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/organizations/{uuid}/audit-logs/{auditUuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

Notifications

Owner or admin personal notification inbox and channel preferences. Notifications are user-scoped, not organization-scoped. Developers and viewers cannot access this inbox. Delivery happens through email and in-app channels queued on the existing operation queues.

GET /notifications List notifications

List notifications

Paginated newest-first inbox for the authenticated user. Filter by unread=1, category, type, or organization (UUID of a membership). Max 100 per page.

Owner or admin Bearer No permission check

The inbox is personal. organisation_id query parameters do not grant access to another tenant.
Passwords, tokens, and secrets are omitted from notification data.
The authenticated user must be an owner or admin of at least one organization.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Query parameters

Field	Type	Required	Description	Example
unread	integer	optional	Set to 1 to return unread notifications only.	1
category	string	optional	Filter by notification category.	security
type	string	optional	Filter by notification type code.	repository.created
organization	uuid	optional	Limit to a membership organization UUID. Does not grant access to another tenant.	01a0c9ee-a340-7337-b752-0de37ae31312
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response fields

Field	Type	Description	Example
data[].uuid	uuid	Public UUIDv7 identifier. Use this in URLs, never the internal numeric id.	01a0c9ee-b800-7000-8000-000000000009
data[].title	string	Notification title.	Repository created
data[].category	string	Notification category.	repository
data[].read_at	datetime	When the notification was marked read. Null if unread.	null

Response 200 example

{
    "data": [
        {
            "uuid": "01a0c9ee-b800-7000-8000-000000000009",
            "title": "Repository created",
            "category": "repository",
            "read_at": null
        }
    ]
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/notifications" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/notifications');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/notifications', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

GET /notifications/unread-count Unread count

Unread count

Returns { count } using the recipient + read_at index. Does not load notification rows.

Owner or admin Bearer No permission check

The inbox is personal. organisation_id query parameters do not grant access to another tenant.
Passwords, tokens, and secrets are omitted from notification data.
The authenticated user must be an owner or admin of at least one organization.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Response fields

Field	Type	Description	Example
count	integer	Unread notification count.	3

Response 200 example

{
    "count": 3
}

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/notifications/unread-count" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/notifications/unread-count');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/notifications/unread-count', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

GET /notifications/{notificationUuid} Get a notification

Get a notification

Returns title, body, category, and read_at. Another user's UUID 404s.

Owner or admin Bearer No permission check

The inbox is personal. organisation_id query parameters do not grant access to another tenant.
Passwords, tokens, and secrets are omitted from notification data.
The authenticated user must be an owner or admin of at least one organization.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
notificationUuid	uuid	required	In-app notification public ID for the authenticated user.	01a0c9ee-b800-7000-8000-000000000009

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/notifications/{notificationUuid}" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/notifications/{notificationUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/notifications/{notificationUuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /notifications/{notificationUuid}/read Mark as read

Mark as read

Sets read_at for the authenticated user's notification only.

Owner or admin Bearer No permission check

The inbox is personal. organisation_id query parameters do not grant access to another tenant.
Passwords, tokens, and secrets are omitted from notification data.
The authenticated user must be an owner or admin of at least one organization.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
notificationUuid	uuid	required	In-app notification public ID for the authenticated user.	01a0c9ee-b800-7000-8000-000000000009

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/notifications/{notificationUuid}/read" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/notifications/{notificationUuid}/read');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/notifications/{notificationUuid}/read', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

POST /notifications/read-all Mark all as read

Mark all as read

Updates unread rows belonging to the authenticated user.

Owner or admin Bearer No permission check

The inbox is personal. organisation_id query parameters do not grant access to another tenant.
Passwords, tokens, and secrets are omitted from notification data.
The authenticated user must be an owner or admin of at least one organization.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/notifications/read-all" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/notifications/read-all');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/notifications/read-all', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

GET /notification-preferences List preferences

List preferences

Merged defaults and stored overrides for customer-facing notification types and implemented channels.

Owner or admin Bearer No permission check

The inbox is personal. organisation_id query parameters do not grant access to another tenant.
Passwords, tokens, and secrets are omitted from notification data.
The authenticated user must be an owner or admin of at least one organization.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Query parameters

Field	Type	Required	Description	Example
page	integer	optional	Page number. Default 1.	1
per_page	integer	optional	Page size. Default 20, maximum 100.	25

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/notification-preferences" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/notification-preferences');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/notification-preferences', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

PATCH /notification-preferences Update preferences

Update preferences

Body: { "preferences": { "repository.created": { "email": false, "in_app": true } } }. Unknown types/channels 422. Critical security types cannot be disabled.

Owner or admin Bearer No permission check application/json

The inbox is personal. organisation_id query parameters do not grant access to another tenant.
Passwords, tokens, and secrets are omitted from notification data.
The authenticated user must be an owner or admin of at least one organization.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Authorization	string	required	Owner or admin Bearer `rt_live_…` only. Organization credentials, developers, and viewers are rejected. Do not put secrets in the query string.	Bearer rt_live_…

Request body fields

Field	Type	Required	Description	Example
preferences	object	required	Map of notification type to channel flags.	{ "repository.created": { "email": false, "in_app": true } }
preferences.{type}.email	boolean	optional	Email channel. Critical security types cannot be disabled.	true
preferences.{type}.in_app	boolean	optional	In-app inbox channel.	true

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "preferences": {
        "storage.limit_warning": {
            "email": true,
            "in_app": true
        }
    }
}

Code examples

curl -X PATCH "http://api1.truerepos.com/api/v1/notification-preferences" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer rt_live_OWNER_OR_ADMIN"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/notification-preferences');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Authorization: Bearer rt_live_OWNER_OR_ADMIN',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/notification-preferences', {
  method: 'PATCH',
  headers: {
    'Accept': 'application/json',
    'Authorization': 'Bearer rt_live_OWNER_OR_ADMIN',
  },
});

const payload = await response.json();
console.log(payload);

Admin panel

Administrative orchestration for dashboard statistics, profile, sessions, search, system health, and operation monitoring. Domain modules remain the source of truth.

GET /admin/dashboard Platform statistics with optional period=today|7d|30d|90d|custom

Platform statistics with optional period=today|7d|30d|90d|custom

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/dashboard" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/dashboard');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/dashboard', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /admin/profile Current administrator profile. Password hashes are never returned.

Current administrator profile. Password hashes are never returned.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/profile" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/profile');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/profile', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

PATCH /admin/profile Update name, timezone, and locale. Protected fields are ignored.

Update name, timezone, and locale. Protected fields are ignored.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X PATCH "http://api1.truerepos.com/api/v1/admin/profile" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/profile');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/profile', {
  method: 'PATCH',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

POST /admin/profile/password Change password. Requires current_password. Other sessions are revoked.

Change password. Requires current_password. Other sessions are revoked.

Authenticated administrator admin application/json

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Request body fields

Field	Type	Required	Description	Example
current_password	string	required	Current password. Required to change password.	...
password	string	required	Account password. Never logged or returned. Reset requires at least 12 characters.	...
password_confirmation	string	required	Must match password.	...

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "current_password": "...",
    "password": "...",
    "password_confirmation": "..."
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/admin/profile/password" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/profile/password');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/profile/password', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

POST /admin/profile/email/change Request an email change. A hashed verification token is mailed; the email is not replaced immediately.

Request an email change. A hashed verification token is mailed; the email is not replaced immediately.

Authenticated administrator admin application/json

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Request body fields

Field	Type	Required	Description	Example
email	email	optional	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "email": "[email protected]"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/admin/profile/email/change" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/profile/email/change');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/profile/email/change', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

POST /admin/profile/email/confirm Confirm an email change with the mailed token.

Confirm an email change with the mailed token.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/admin/profile/email/confirm" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/profile/email/confirm');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/profile/email/confirm', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

POST /admin/auth/forgot-password Always returns a generic message. Does not reveal whether the email exists.

Always returns a generic message. Does not reveal whether the email exists.

None No permission check application/json

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Content-Type	string	required	Body encoding for this endpoint.	application/json

Request body fields

Field	Type	Required	Description	Example
email	email	optional	Organization contact email. Unique across organizations. Maximum 191 characters.	[email protected]

Response 200 example

Empty body, or a live payload from the tester.

Request JSON example

{
    "email": "[email protected]"
}

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/admin/auth/forgot-password" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/auth/forgot-password');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/auth/forgot-password', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

POST /admin/auth/reset-password Reset with token, OTP code, and a policy-compliant password. Tokens are single-use.

Reset with token, OTP code, and a policy-compliant password. Tokens are single-use.

None No permission check

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/admin/auth/reset-password" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/auth/reset-password');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/auth/reset-password', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /admin/sessions List administrator sessions. The current session is marked current=true.

List administrator sessions. The current session is marked current=true.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/sessions" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/sessions');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/sessions', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

POST /admin/sessions/{id}/revoke Revoke another session. The current session cannot be revoked here.

Revoke another session. The current session cannot be revoked here.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
id	string	required	Path parameter `id`.	{id}

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/admin/sessions/{id}/revoke" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/sessions/{id}/revoke');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/sessions/{id}/revoke', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

POST /admin/sessions/revoke-all Revoke every other session and keep the current one.

Revoke every other session and keep the current one.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/admin/sessions/revoke-all" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/sessions/revoke-all');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/sessions/revoke-all', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /admin/preferences UI preferences: timezone, locale, dashboard period, items per page.

UI preferences: timezone, locale, dashboard period, items per page.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/preferences" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/preferences');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/preferences', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

PATCH /admin/preferences Update UI preferences. Notification channel preferences stay in the Notification module.

Update UI preferences. Notification channel preferences stay in the Notification module.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X PATCH "http://api1.truerepos.com/api/v1/admin/preferences" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/preferences');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'PATCH',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/preferences', {
  method: 'PATCH',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /admin/activity Paginated audit_logs for administrators. Filter by event, action, resource_type, status, actor, date_from, date_to.

Paginated audit_logs for administrators. Filter by event, action, resource_type, status, actor, date_from, date_to.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/activity" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/activity');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/activity', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /admin/search Grouped search across approved fields. Query q is required (min 2 characters).

Grouped search across approved fields. Query q is required (min 2 characters).

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/search" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/search');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/search', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /admin/system/health Lightweight health of application, database, cache, queue, storage, and mail. Secrets are never included.

Lightweight health of application, database, cache, queue, storage, and mail. Secrets are never included.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/system/health" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/system/health');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/system/health', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /admin/organizations/{uuid} Aggregated organization overview from existing domain modules.

Aggregated organization overview from existing domain modules.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
uuid	uuid	required	Organization public ID (UUIDv7). Never use the internal numeric id.	01a0c9ee-a340-7337-b752-0de37ae31312

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/organizations/{uuid}" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/organizations/{uuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/organizations/{uuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /admin/operations Paginated operations. Filter status, operation_type, organization, created_from, created_to. Metadata is omitted from the list.

Paginated operations. Filter status, operation_type, organization, created_from, created_to. Metadata is omitted from the list.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/operations" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/operations');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/operations', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /admin/operations/{operationUuid} Operation detail with sanitized metadata.

Operation detail with sanitized metadata.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
operationUuid	uuid	required	Background operation public ID. Laravel job IDs are never customer-facing.	01a0c9ee-b900-7000-8000-00000000000a

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/operations/{operationUuid}" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/operations/{operationUuid}');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/operations/{operationUuid}', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

POST /admin/operations/{operationUuid}/retry Retry using the Operation module.

Retry using the Operation module.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
operationUuid	uuid	required	Background operation public ID. Laravel job IDs are never customer-facing.	01a0c9ee-b900-7000-8000-00000000000a

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/admin/operations/{operationUuid}/retry" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/operations/{operationUuid}/retry');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/operations/{operationUuid}/retry', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

POST /admin/operations/{operationUuid}/cancel Cancel using the Operation module.

Cancel using the Operation module.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
operationUuid	uuid	required	Background operation public ID. Laravel job IDs are never customer-facing.	01a0c9ee-b900-7000-8000-00000000000a

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/admin/operations/{operationUuid}/cancel" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/operations/{operationUuid}/cancel');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/operations/{operationUuid}/cancel', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /admin/notifications Administrator inbox from the Notification module.

Administrator inbox from the Notification module.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/notifications" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/notifications');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/notifications', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

GET /admin/notifications/unread-count Unread administrator notification count.

Unread administrator notification count.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X GET "http://api1.truerepos.com/api/v1/admin/notifications/unread-count" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/notifications/unread-count');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/notifications/unread-count', {
  method: 'GET',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);

POST /admin/notifications/{notificationUuid}/read Mark an administrator notification as read.

Mark an administrator notification as read.

Authenticated administrator admin

Admin APIs require the admin session cookie. Customer access tokens are rejected.
Passwords, reset tokens, session secrets, and infrastructure credentials are never returned.

Headers

Field	Type	Required	Description	Example
Accept	string	required	Must be application/json so validation and auth failures return JSON.	application/json
Cookie	string	optional	Session cookie from POST /auth/login. Same-origin browser requests send this automatically.	laravel_session=…
Authorization	string	optional	Bearer rt_live_ token. Use this for Composer, NPM, and API clients. Do not put tokens in the query string.	Bearer rt_live_…

Path parameters

Field	Type	Required	Description	Example
notificationUuid	uuid	required	In-app notification public ID for the authenticated user.	01a0c9ee-b800-7000-8000-000000000009

Response 200 example

Empty body, or a live payload from the tester.

Code examples

curl -X POST "http://api1.truerepos.com/api/v1/admin/notifications/{notificationUuid}/read" \
  -H "Accept: application/json" \
  -H "Cookie: laravel_session=YOUR_SESSION_COOKIE"

<?php

$ch = curl_init('http://api1.truerepos.com/api/v1/admin/notifications/{notificationUuid}/read');

curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Accept: application/json',
        'Cookie: laravel_session=YOUR_SESSION_COOKIE',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

const response = await fetch('http://api1.truerepos.com/api/v1/admin/notifications/{notificationUuid}/read', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Cookie': 'laravel_session=YOUR_SESSION_COOKIE',
  },
});

const payload = await response.json();
console.log(payload);