Browse documentation

Automation and agents

HTTP API

Call the stable versioned HTTP API with scoped bearer or capability tokens.

Call the API

first API calls
curl https://api.blobyard.com/v1/health curl -H "Authorization: Bearer $BLOBYARD_TOKEN" https://api.blobyard.com/v1/cli/whoami

The base URL is https://api.blobyard.com/v1. Every response carries an X-Request-Id header and a matching requestId field. Rate-limited responses add Retry-After.

Read the response envelope

success and error envelopes
{ "ok": true, "data": {}, "requestId": "req_9f2c4c8a" } { "ok": false, "error": { "code": "AUTH_REQUIRED", "message": "Sign in with blobyard login." }, "requestId": "req_9f2c4c8a" }

Successful responses wrap the payload in data. Failures return one stable error code and a redaction-safe message. Branch on ok and error.code, never on message text.

Choose an authentication mode

  • CLI session tokens: opaque bearer tokens issued by the device flow, fifteen-minute access with rotating refresh.
  • API tokens: byd_pat_ prefixed bearer tokens created in Settings or with blobyard tokens create, with explicit scopes and a bounded expiry.
  • CI machine tokens: minted by posting a GitHub OIDC assertion to /v1/ci/github/oidc/exchange, valid for at most fifteen minutes.
  • Capability tokens: high-entropy public tokens for shares and inboxes, passed as a token query parameter or request-body field.

Find the route

AreaRoutes
Device and sessionPOST /cli/device/start, POST /cli/device/poll, POST /cli/token/refresh, POST /cli/logout, GET /cli/whoami
Workspaces and projectsGET and POST /workspaces, GET and POST /projects
UploadsPOST /uploads/request, /uploads/parts/request, /uploads/complete, /uploads/abort, GET /uploads/status
ObjectsGET and DELETE /objects, POST /downloads/request
SharesPOST and GET /shares, GET /shares/resolve, POST /shares/download, POST /shares/revoke
PreviewsPOST and GET /previews, POST /previews/revoke
InboxesPOST and GET /inboxes, GET /inboxes/resolve, POST /inboxes/revoke
RetentionGET, PUT, and DELETE /retention
Web YardsGET /yards, POST /yards/deploys/start, POST /yards/deploys/finalise, POST /yards/deploys/fail, GET /yards/deploys, POST /yards/rollback, POST /yards/delete
AutomationPOST /ci/github/oidc/exchange
Workspace administrationGET /audit, GET /members, GET and POST /members/invites, POST /members/invites/revoke, POST /members/role, POST /members/remove
API tokens, CI trusts, and CLI sessionsGET and POST /api-tokens, POST /api-tokens/revoke, GET and POST /ci/trusts, POST /ci/trusts/revoke, GET /cli/sessions, POST /cli/sessions/revoke
BillingGET /billing, POST /billing/checkout, POST /billing/portal, POST /billing/subscription/update, POST /billing/storage/checkout, POST /billing/storage/update
Account lifecycleGET and POST /account/exports, POST /account/exports/download, GET /account/deletion, POST /account/deletion/prepare, POST /account/deletion/complete, POST /account/deletion/retry
One-time secretsPOST /secrets, POST /secrets/redeem

This page summarizes the current 73-operation release candidate by workflow. The generated OpenAPI document is the complete method, path, schema, and surface inventory for this build. Production clients should compare it with the deployed document before assuming a release candidate route is live.