API reference
The requests behind the routing.
Endpoints
Admin credentials register and remove workspaces and inspect overall status. Session credentials are restricted to their own workspace. Use HTTPS outside loopback.
| Request | Purpose |
|---|---|
POST /sessions | Register id, token, and optional exact callback (admin) |
POST /sessions/{id}/poll | Get pending delivery metadata with {} |
GET /sessions/{id}/events/{delivery}?attempt=1 | Fetch the raw original payload, without a JSON envelope or base64 |
POST /sessions/{id}/ack | Acknowledge {"delivery":"…","attempt":1} |
POST /sessions/{id}/replay | Requeue {"delivery":"…"} |
POST /sessions/{id}/claim | Claim {"repo":12345678,"pr":42} |
POST /sessions/{id}/oauth | Create a single-use Google callback transaction |
POST /sessions/{id}/remove | Remove a workspace and its state (admin) |
POST /status | Overall queue and workspace counts (admin) |
GET /healthz | Database connectivity check (public) |
All protected requests use Authorization: Bearer <token>. A poll returns metadata such as:
{"events":[{"delivery":"github-delivery-id","event":"pull_request","signature":"sha256=…","attempt":1}]}Fetch the raw body separately, forward it unchanged, then acknowledge its current attempt. A stale attempt returns 409; poll again. The raw response includes X-GitHub-Delivery, X-GitHub-Event, X-Hub-Signature-256, and X-Pepe-Attempt. Run one consumer per workspace identity; delivery is at least once.