---
title: "PUT /settings/ci-builder"
method: PUT
path: "/settings/ci-builder"
tags: ["CI builder"]
---

# PUT /settings/ci-builder

`PUT /settings/ci-builder`

## Request

- Base URL: `/api` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/settings/ci-builder`
- Auth: HTTP bearer

## Request body

- CiExecutorSettings
  - `control_plane_url` string, required
  - `dispatch_token` string, password: A credential. Write-only: it is never returned, and the AI assistant supplies it through a secret slot instead of typing it into the conversation.
  - `git_ref` string, required
  - `identity` TrustedIdentityIssuer, required: Public trust policy; no hardcoded provider-specific token validator.
    - `audience` string, required
    - `issuer` string, required
    - `jwks_url` string, required
    - `subject` string, required
  - `image_repository` string, required
  - `limits` BuildLimits, required: Operator settings persisted on each node. These are control-plane operations, independent of the proxy request path. Existing agents keep their fixed limits.
    - `build_timeout_seconds` integer
    - `concurrency` integer
    - `queue_wait_seconds` integer
  - `organization` boolean, required
  - `owner` string, required
  - `registry_credentials` RemotePullCredentials: Registry credentials to forward to the worker's `POST /agent/images/pull` call. Mirrors the wire shape of `temps_agent::RegistryCredentials` field for field; `temps-deployer` does not depend on `temps-agent` (the same reason `import_image` below builds its own request rather than sharing a DTO type), so this struct only needs to serialize to the JSON body the agent handler already deserializes.
    - `identity_token` string, password: A credential. Write-only: it is never returned, and the AI assistant supplies it through a secret slot instead of typing it into the conversation.
    - `password` string, password: A credential. Write-only: it is never returned, and the AI assistant supplies it through a secret slot instead of typing it into the conversation.
    - `server_address` string, nullable
    - `username` string, nullable
  - `repository` string, required
  - `runner_archive_sha256` string, required
  - `runner_archive_url` string, required: Pinned release archive used by the generated CI shim.

## Response `200`

- CiExecutorStatus
  - `configured` boolean, required
  - `reason` string, nullable
  - `settings` CiExecutorSettings
    - `control_plane_url` string, required
    - `dispatch_token` string, password: A credential. Write-only: it is never returned, and the AI assistant supplies it through a secret slot instead of typing it into the conversation.
    - `git_ref` string, required
    - `identity` TrustedIdentityIssuer, required: Public trust policy; no hardcoded provider-specific token validator.
      - `audience` string, required
      - `issuer` string, required
      - `jwks_url` string, required
      - `subject` string, required
    - `image_repository` string, required
    - `limits` BuildLimits, required: Operator settings persisted on each node. These are control-plane operations, independent of the proxy request path. Existing agents keep their fixed limits.
      - `build_timeout_seconds` integer
      - `concurrency` integer
      - `queue_wait_seconds` integer
    - `organization` boolean, required
    - `owner` string, required
    - `registry_credentials` RemotePullCredentials: Registry credentials to forward to the worker's `POST /agent/images/pull` call. Mirrors the wire shape of `temps_agent::RegistryCredentials` field for field; `temps-deployer` does not depend on `temps-agent` (the same reason `import_image` below builds its own request rather than sharing a DTO type), so this struct only needs to serialize to the JSON body the agent handler already deserializes.
      - `identity_token` string, password: A credential. Write-only: it is never returned, and the AI assistant supplies it through a secret slot instead of typing it into the conversation.
      - `password` string, password: A credential. Write-only: it is never returned, and the AI assistant supplies it through a secret slot instead of typing it into the conversation.
      - `server_address` string, nullable
      - `username` string, nullable
    - `repository` string, required
    - `runner_archive_sha256` string, required
    - `runner_archive_url` string, required: Pinned release archive used by the generated CI shim.
  - `setup_path` string, required

## Other responses

- `400`: Invalid settings
- `401`: Unauthorized
- `403`: Forbidden
- `500`: Storage failed

## Changes

> 81 revisions in range; 1 not diffed.

- **2026-10-20** `79089e9f49ee`: 12 breaking, 3 info
  - the request property `dispatch_token` became not nullable
  - the request property `registry_credentials/oneOf[#/components/schemas/RemotePullCredentials]/identity_token` became not nullable
  - the request property `registry_credentials/oneOf[#/components/schemas/RemotePullCredentials]/password` became not nullable
  - the `dispatch_token` request property type changed from `string, null` to no type
  - …11 more
- **2026-10-17** `de8eaf663007`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/gotempsh/apis/temps/changes/settings/ci-builder/put.md)

---

[API](https://skmtc.dev/gotempsh/apis/temps.md) · [All operations](https://skmtc.dev/gotempsh/apis/temps/llms.txt) · [OpenAPI document](https://skmtc.dev/gotempsh/apis/temps/revisions/ab6d5d19e930?raw)