Oore CI
ReferenceAPICategories

Setup

Health check endpoint Initial instance setup flow (bootstrap token → mode-aware owner creation). Auto-disabled after setup completes.

Health check

GET
/healthz

Returns daemon build metadata when the daemon is running.

Response Body

application/json

curl -X GET "https://example.com/healthz"
{  "channel": "string",  "github_repo": "string",  "ok": true,  "package_version": "string",  "version": "string"}

Readiness check

GET
/readyz

Reports whether the database, migrations, and runtime encryption key are ready to serve requests.

Response Body

application/json

application/json

curl -X GET "https://example.com/readyz"
{  "database": true,  "encryption": true,  "migrations": true,  "ok": true}

Exchange a frontend pairing code

POST
/v1/frontend/pair

Exchanges a short-lived, single-use code created by oore frontend invite for the backend trusted-proxy proof and configured identity header. This endpoint accepts requests only from configured trusted-proxy peer CIDRs.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/frontend/pair" \  -H "Content-Type: application/json" \  -d '{    "code": "string"  }'
{  "backend_proof": "string",  "user_email_header": "string"}

Get setup status

GET
/v1/public/setup-status

Returns the current setup state and instance ID. This endpoint is always public and contains no sensitive information.

Response Body

application/json

application/json

curl -X GET "https://example.com/v1/public/setup-status"
{  "instance_id": "string",  "is_configured": true,  "remote_auth_mode": "oidc",  "runtime_mode": "local",  "setup_mode": true,  "state": "uninitialized"}

Verify bootstrap token

POST
/v1/setup/bootstrap-token/verify

Exchanges a one-time bootstrap token (generated by the CLI) for a setup session token. Rate-limited: 5 failed attempts per token hash triggers lockout.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/setup/bootstrap-token/verify" \  -H "Content-Type: application/json" \  -d '{    "token": "string"  }'
{  "expires_at": 0,  "session_token": "string"}

Complete setup

POST
/v1/setup/complete

Finalises the setup flow, transitions state to ready, inserts the owner into the users table, and clears the setup session.

Authorization

bearer_auth
AuthorizationBearer <token>

In: header

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/v1/setup/complete"
{  "instance_id": "string",  "state": "uninitialized"}

Create local owner (local mode)

POST
/v1/setup/local-owner/create

Creates the setup owner without OIDC when runtime mode is local.

Authorization

bearer_auth
AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/setup/local-owner/create" \  -H "Content-Type: application/json" \  -d '{    "email": "string"  }'
{  "owner_email": "string",  "session_expires_at": 0,  "state": "uninitialized"}

Configure OIDC provider

POST
/v1/setup/oidc/configure

Performs OIDC discovery on the provided issuer URL and stores the provider configuration. Requires a valid setup session.

Authorization

bearer_auth
AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/setup/oidc/configure" \  -H "Content-Type: application/json" \  -d '{    "client_id": "string",    "issuer_url": "string"  }'
{  "discovered_issuer": "string",  "session_expires_at": 0,  "state": "uninitialized"}

Claim owner identity from trusted proxy headers

POST
/v1/setup/owner/claim-trusted-proxy

Creates the owner record from trusted proxy identity headers after the proxy-authenticated email matches the configured setup owner email.

Authorization

bearer_auth
AuthorizationBearer <token>

In: header

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/setup/owner/claim-trusted-proxy"
{  "owner_email": "string",  "session_expires_at": 0,  "state": "uninitialized"}

Start owner OIDC flow

POST
/v1/setup/owner/start-oidc

Initiates the OIDC authorization code flow to create the instance owner. Returns an authorization URL for the frontend to redirect to.

Authorization

bearer_auth
AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/setup/owner/start-oidc" \  -H "Content-Type: application/json" \  -d '{    "redirect_uri": "string"  }'
{  "authorization_url": "string",  "state": "string"}

Verify owner OIDC callback

POST
/v1/setup/owner/verify-oidc

Completes the setup OIDC flow by exchanging the authorization code for tokens and creating the owner account.

Authorization

bearer_auth
AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/setup/owner/verify-oidc" \  -H "Content-Type: application/json" \  -d '{    "code": "string",    "state": "string"  }'
{  "oidc_subject": "string",  "owner_email": "string",  "session_expires_at": 0,  "state": "uninitialized"}

Persist setup mode preferences

POST
/v1/setup/preferences

Stores setup-time runtime mode and remote auth mode before owner creation.

Authorization

bearer_auth
AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/v1/setup/preferences" \  -H "Content-Type: application/json" \  -d '{    "runtime_mode": "local"  }'
{  "remote_auth_mode": "oidc",  "runtime_mode": "local",  "session_expires_at": 0}

Get setup summary

GET
/v1/setup/summary

Returns a summary of current setup configuration. Requires a valid setup session.

Authorization

bearer_auth
AuthorizationBearer <token>

In: header

Response Body

application/json

application/json

curl -X GET "https://example.com/v1/setup/summary"
{  "client_id": "string",  "has_client_secret": true,  "instance_id": "string",  "issuer_url": "string",  "owner_email": "string",  "state": "uninitialized"}

Configure trusted proxy auth during setup

POST
/v1/setup/trusted-proxy/configure

Upserts trusted proxy settings for remote trusted-proxy mode, including the expected initial owner email.

Authorization

bearer_auth
AuthorizationBearer <token>

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/setup/trusted-proxy/configure" \  -H "Content-Type: application/json" \  -d '{}'
{  "configured_at": 0,  "has_shared_secret": true,  "session_expires_at": 0,  "setup_owner_email": "string",  "state": "uninitialized"}

Pipelines

Pipeline configuration — build platforms, commands, triggers, concurrency. Code signing configuration — Android keystores, iOS certificates/profiles.

Logs

Build log ingestion and retrieval — append, paginated fetch, SSE streaming. Read-only audit trail of all user and system actions.