[{"data":1,"prerenderedAt":124},["ShallowReactive",2],{"docs:en:rest-api":3},{"id":4,"meta":5,"intro":8,"contractVersion":11,"contractVersionLabel":12,"contractNotice":13,"contractDownload":14,"labels":17,"sections":29},"rest-api",{"title":6,"lead":7},"REST API","Every route an API key can call, read from the OpenAPI contract that ships inside the service.",{"title":9,"lead":10},"REST API reference","What the API exposes, where each route lives, and what a key needs to carry to be let through.","1.15.0","Contract version","The reference below is read from the OpenAPI contract, which is written in English. It is not translated on purpose: translating it would mean copying it, and a copy drifts.",{"href":15,"label":16},"\u002Fopenapi.json","Download the public contract (OpenAPI, JSON)",{"method":18,"path":19,"summary":20,"scope":21,"authentication":22,"form":23,"name":24,"type":25,"notes":26,"description":27,"downloadContract":16,"contractVersion":12,"command":28},"Method","Path","What it does","Key scope","Accepts","On the request","Name","Type","Notes","Description","Command",[30,39,60],{"id":31,"title":32,"paragraphs":33,"block":38},"overview","Where this page comes from",[34,35,36,37],"This reference is not written, it is read. Every route, method and scope below comes from the OpenAPI contract compiled into the API binary, and a check compares that contract against the running code on every build.","A reference kept by hand starts drifting the week after it is written, and from then on it is worse than no reference at all, because it is believed. The only way not to drift is not to have a second copy to drift from.","What is listed here are the operations an API key can call, and nothing else. The dashboard drives the rest of the service through routes that only a browser session reaches: they are not part of the public API, they change without notice, and documenting them would turn them into a promise nobody made.","What you find here is the surface: where a route lives and what it is for. The contract itself carries the rest — request and response schemas, error codes, rate limits — and it is the document to read when a call answers something you did not expect. The copy you can download holds the same operations as this page, and only those.",null,{"id":40,"title":41,"paragraphs":42,"block":46},"authentication","Authentication",[43,44,45],"Three ways to prove who you are, and they are not interchangeable. A scoped key is the one meant for programs; the session is the one your browser holds while you use the dashboard.","Write scopes do not imply read scopes. Otherwise someone looking at a key would see jobs:write and have to remember that it covers reading too.","The operations that accept no key at all — issuing credentials, committing to a payment, destroying an account — are absent from this page for exactly that reason. It is a decision rather than an omission: a key that could mint another key would make revoking the first one pointless.",{"kind":47,"schemes":48},"schemes",[49,53,57],{"name":50,"form":51,"description":52},"sessionCookie","Cookie: pq_session=…","Browser session (R14). HttpOnly: the token is out of reach of JavaScript, so an XSS on the dashboard cannot carry it away.",{"name":54,"form":55,"description":56},"sessionBearer","Authorization: Bearer …","The same session token, for clients without a cookie jar. When both arrive, the cookie wins — it is the session the user expects to be using.",{"name":58,"form":55,"description":59},"apiKey","Scoped API key (R9): Authorization: Bearer pq_live_.... The prefix is what tells it apart from a session token without having to try both. The scope each operation requires is declared in x-api-key-scope, and it is compared against the code on every CI run. Write scopes do not imply read scopes: otherwise someone looking at a key's scopes would see jobs:write and have to remember that it covers reading too. Operations that do not declare this scheme do not accept a key, ever: they are the ones that issue credentials, commit to a payment, or destroy the account.",{"id":61,"title":62,"paragraphs":63,"block":65},"operations","Operations",[64],"Grouped the way the contract groups them. A path in braces is a parameter you replace; the scope column is what a key must carry for that call to be allowed through.",{"kind":61,"groups":66},[67,115],{"name":68,"description":69,"operations":70},"jobs","Cron jobs and executions (R8).",[71,77,82,86,90,94,99,103,107,111],{"method":72,"path":73,"summary":74,"scope":75,"security":76},"GET","\u002Fjobs","List jobs (R8)","jobs:read",[50,54,58],{"method":78,"path":73,"summary":79,"scope":80,"security":81},"POST","Create a job (R1, R8)","jobs:write",[50,54,58],{"method":72,"path":83,"summary":84,"scope":75,"security":85},"\u002Fjobs\u002F{id}","Read one job",[50,54,58],{"method":87,"path":83,"summary":88,"scope":80,"security":89},"PATCH","Partially update a job",[50,54,58],{"method":91,"path":83,"summary":92,"scope":80,"security":93},"DELETE","Delete a job",[50,54,58],{"method":72,"path":95,"summary":96,"scope":97,"security":98},"\u002Fjobs\u002F{id}\u002Fexecutions","Execution log (R6)","executions:read",[50,54,58],{"method":78,"path":95,"summary":100,"scope":101,"security":102},"Run now (R8)","executions:trigger",[50,54,58],{"method":72,"path":104,"summary":105,"scope":97,"security":106},"\u002Fjobs\u002F{id}\u002Fexecutions\u002Fstream","Execution log in real time (SPEC §4.2)",[50,54,58],{"method":72,"path":108,"summary":109,"scope":97,"security":110},"\u002Fexecutions\u002Fexport","Download the execution log (R27)",[50,54,58],{"method":72,"path":112,"summary":113,"scope":97,"security":114},"\u002Fexecutions\u002Fmetrics","Duration, failure rate and trend (R28)",[50,54,58],{"name":116,"description":117,"operations":118},"secrets","Workspace secrets resolved at execution time (R42, R43).",[119],{"method":72,"path":120,"summary":121,"scope":122,"security":123},"\u002Fsecrets","List workspace secrets (R42)","secrets:read",[50,54,58],1788438713281]