---
title: "Configure repository PR/MR previews, fork consent and compute limits"
method: POST
path: "/platform/deployments/custom/{id}/previews/pull-requests"
tags: ["Platform"]
---

# Configure repository PR/MR previews, fork consent and compute limits

`POST /platform/deployments/custom/{id}/previews/pull-requests`

## Request

- Base URL: `https://api.imprezahost.com/v1`
- URL: `https://api.imprezahost.com/v1/platform/deployments/custom/{id}/previews/pull-requests`
- Auth: API key in header `X-API-Key` and API key in header `X-API-Secret`

Requires deploy scope. Creates no preview: only a verified GitHub Pull request
or GitLab Merge request webhook can establish a PR identity. Also enable
previews_enabled in the existing preview settings. When this policy is enabled,
branch pushes stop creating additional previews; production push deploys continue.
Enable Pull requests on existing GitHub hooks or Merge request events in GitLab.
New GitHub webhook connections subscribe to push and pull_request.

Opening, committing and reopening use repository + PR number as identity.
Branch rename keeps the live onion. Closing or merging requests a purge teardown,
even if the branch remains. Reopening after teardown creates fresh onion keys.
Previews use their own volumes, which are deleted after agent confirmation.
The hidden service stops; old onion keys are parked for a 30-day recovery
retention, with best-effort pruning during later Tor operations. Reopening
uses fresh keys. Production data is never copied or deleted. Backups already
stored in your S3 account survive until your retention policy or explicit deletion.
Your VPS and its billing continue; retiring a preview does not cancel the server.

Forks require explicit consent for this connected repository. They receive no
inherited application variables, build secrets or deployment Git credential.
The agent must announce preview-fork-sandbox-v1 and explicitly prepared controlled-build-v1 with deploy-progress-v1. Fork builds reserve 1 CPU and 768 MiB inside the preview budget, use only fixed public official base images and COPY, and refuse custom Dockerfile frontends, private bases, ADD and VOLUME. Fork builds run without network
access; dependencies must already be available in the build context or base image.
Runtime is confined by the F46 sandbox, with no volumes and private egress denied.
The maximum fork runtime lifetime is 24 hours, even with a longer parent TTL.

Compute limits cover the sum of live preview CPU and memory reservations, including
previews still tearing down. Excess count, compute or concurrent build work is deferred;
provider retries can retry it. Periodic reconciliation reads existing PR identities
with your deployment PAT (PR read permission required). An SSH deploy key cannot
read the PR API. Provider outage preserves live previews and retries on a later sweep.

Comments are off by default. They need a separate, repository-scoped comment write
token and publish_comments=true. No deployment read credential is used to write a
comment. A comment exposes the onion address to everyone who can read the PR,
including the public for a public repository. Turning comments off deletes that token.

## Path parameters

- `id` string, required

## Request body

- object
  - `enabled` boolean
  - `provider` 'github' | 'gitlab'
  - `allow_forks` boolean
  - `max_cpus` number
  - `max_memory_mb` integer
  - `max_parallel_builds` integer
  - `publish_comments` boolean
  - `comment_token` string

## Response `200`

Stored policy and webhook setup guidance

## Other responses

- `400`: Invalid policy or missing explicit comment write token
- `403`: Deploy scope required
- `404`: No such deployment on this account
- `503`: Lifecycle storage or lock unavailable; retry later

---

[API](https://skmtc.dev/imprezahost/apis/impreza-host-public-api.md) · [All operations](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/revisions/db86511f604f?raw)