API reference

Auth

Exchange an OIDC token from GitHub Actions or an agent sandbox for a one-hour cell token.

GET/v1/ci/auth/config

Get the sign-in config

Where a person signs in: issuer, device grant endpoints, public client id.

No credential

Response200 OK

client_idstringRequired
device_authorization_endpointstringRequired
issuerstringRequired
scopesarray of strings: what the cli asks for; empty for authkit, whose device grant takes no scope
token_endpointstringRequired
verification_domainsarray of strings: domains the issuer serves its device page under besides its own hosts (authkit's <org>.authkit.app), named by the identity adapter, so the cli's browser opener needs no vendor's name

curl "$CIRESK_API/v1/ci/auth/config"

POST/v1/ci/auth/exchange

Exchange an OIDC token

An oidc token for a short-lived cix_ token.

No credential

Request body

repostring or null: uuidv7 rendered as repo_<32 hex>
requested_scopesarray of strings
tokenstringRequired

Response201 Created

expires_atstring (date-time)Required
principalobjectRequired: Principal: what the cli shows; never the token
principal.credentialstringRequired: prefix only, for example csk_live_eu_abcd
principal.jurisdictionstringRequired: the cell a tenant is pinned to. mirrors ciresk_std_api::Region so the api converts a principal's jurisdiction without a second vocabulary.One of eu, us
principal.kindstringRequired: One of user, api_key, service
principal.org_idstringRequired
principal.scopesarray of stringsRequired
tokenstringRequired
truststringRequired: tiers, with no order on purpose (amendment 2026-10-27): trusted_ci is protected-branch automation and the cache writer every tier reads, trusted_interactive a person's own work, and neither is "below" the other, so every rule over tiers names the tiers it meansOne of untrusted, trusted_ci, trusted_interactive

curl -X POST "$CIRESK_API/v1/ci/auth/exchange" \
  -H "Content-Type: application/json" \
  -d '{
    "repo": "repo_0129354d7b6b4146ad16c315d960365b",
    "requested_scopes": [
      "ci:jobs.run",
      "ci:jobs.read"
    ],
    "token": "eyJ8BmvruZ26jFCCEvEwbA7pXZKEDVe4ws3AZNJGBhxAMyGPGFnOE75jGkGAbeU"
  }'

GET/v1/ci/auth/whoami

Get the caller's principal

The bearer's principal and the organisations it may sign in to.

Response200 OK

orgsarray of objectsRequired
orgs[].idstringRequired
orgs[].jurisdictionstring or null: the cell a tenant is pinned to. mirrors ciresk_std_api::Region so the api converts a principal's jurisdiction without a second vocabulary.One of eu, us
orgs[].namestring or null
orgs[].productsarray of strings: the products the organisation enabled; ci must be among them for a token to work here
principalobjectRequired: Principal: what the cli shows; never the token
principal.credentialstringRequired: prefix only, for example csk_live_eu_abcd
principal.jurisdictionstringRequired: the cell a tenant is pinned to. mirrors ciresk_std_api::Region so the api converts a principal's jurisdiction without a second vocabulary.One of eu, us
principal.kindstringRequired: One of user, api_key, service
principal.org_idstringRequired
principal.scopesarray of stringsRequired
subjectstringRequired: user:<id>, key:<id> or service:<name>

curl "$CIRESK_API/v1/ci/auth/whoami" \
  -H "Authorization: Bearer $CIRESK_KEY"