Skip to content
pkgPlease Docs

Overview

pkgPlease API 1

Section titled “pkgPlease API 1”

REST API backing the pkgPlease dashboard, CLI, and MCP tools. All routes except /healthz require a bearer token; most require an org-scoped pkgPlease token, a few require a Supabase JWT (see each operation's security requirement).

Information

  • OpenAPI version: 3.0.3

Operations

Section titled “Operations”
GET
/api/v1/approvals
POST
/api/v1/approvals
GET
/api/v1/approvals/{id}
PUT
/api/v1/approvals/{id}/approve
PUT
/api/v1/approvals/{id}/deny
GET
/api/v1/audit
GET
/api/v1/audit/summary
GET
/api/v1/audit/events
GET
/api/v1/audit/events/export
GET
/api/v1/audit/packages
GET
/api/v1/audit/agent-activity
GET
/api/v1/audit/agent-approvals
POST
/api/v1/auth/login
GET
/api/v1/auth/tokens
POST
/api/v1/auth/tokens
POST
/api/v1/auth/tokens/provision-agent
DELETE
/api/v1/auth/tokens/{id}
POST
/api/v1/auth/slack/callback
GET
/api/v1/orgs/invites
POST
/api/v1/orgs/invites
DELETE
/api/v1/orgs/invites/{id}
POST
/api/v1/orgs/invites/accept
POST
/api/v1/orgs
GET
/api/v1/packages
POST
/api/v1/packages/score
GET
/api/v1/packages/score/{jobId}
GET
/api/v1/packages/{name}
GET
/api/v1/packages/{name}/{version}
GET
/api/v1/policy/{registry_type}
PUT
/api/v1/policy/{registry_type}
GET
/api/v1/policy/{registry_type}/blocklist
POST
/api/v1/policy/{registry_type}/blocklist
DELETE
/api/v1/policy/{registry_type}/blocklist/{package}
GET
/api/v1/policy/{registry_type}/allowlist
POST
/api/v1/policy/{registry_type}/allowlist
DELETE
/api/v1/policy/{registry_type}/allowlist/{package}
GET
/api/v1/policy/{registry_type}/packs
GET
/api/v1/policy/{registry_type}/packs/{slug}
PUT
/api/v1/policy/{registry_type}/packs/{slug}
POST
/api/v1/policy/{registry_type}/check
POST
/api/v1/policy/{registry_type}/suggest
GET
/healthz

Authentication

Section titled “Authentication”

orgToken

Section titled “orgToken”

Org-scoped pkgPlease token (prefix pkgpls_dev_/pkgpls_svc_/pkgpls_agt_/ pkgpls_prv_/pkgpls_ses_ depending on type). Must include the api audience — a token issued with only the registry audience (e.g. a "Registry only" service token) will be rejected with 403.

Security scheme type: http

Bearer format: pkgpls_*

supabaseAuth

Section titled “supabaseAuth”

Supabase-issued JWT, used before an org-scoped token exists.

Security scheme type: http

Bearer format: JWT