CI Federation

Replace asset_key_scopes on a CI binding

Mutate asset_key_scopes on the binding — gates the spec.assets slice for CI sessions. v1.48 introduced per-binding asset_key_scopes to lock down CI access to the assets slice, but POST /ci/v1/bindings doesn't accept the parameter, so existing bindings default to NULL (closed). This endpoint lets the binding owner (a principal with ci.manage on the project's owning org, same model as revoke) replace the scopes after the fact. Idempotent — calling with the same scope list is a no-op. Each scope is either an exact key (astro/hero.jpg) or a wildcard prefix (astro/*). Wildcards are required for assets.sync.prune to cover the prefix. Bare * and ** are rejected. Cap of 64 entries, 256 chars each, no empty strings.

post/ci/v1/bindings/{binding_id}/asset-scopes

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/ci/v1/bindings/{binding_id}/asset-scopes
  • Auth: API key in header SIGN-IN-WITH-X

Path parameters

binding_idstring required

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Request body

asset_key_scopesstring[] required

Replace-mode list. Each entry is an exact asset key OR a prefix/* wildcard. Empty array means CI sessions cannot mutate assets at all.

Response

Binding updated. Returns the binding row including the new asset_key_scopes.

idstring

Binding id, prefixed bnd_.

project_idstring
issuerstring

OIDC issuer URL (FK to internal.trusted_oidc_issuers). v1 only: https://token.actions.githubusercontent.com.

subject_matchstring
allowed_actionsstring[]
allowed_eventsstring[]

Sorted-deduped on insert. Default ['push','workflow_dispatch'].

route_scopesstring[]

Sorted-deduped explicit route patterns CI may alter. Empty array means CI cannot ship non-null spec.routes.

asset_key_scopesstring[] nullable

Per-binding allowlist for the spec.assets slice. NULL means no asset authority (default for bindings created via POST /ci/v1/bindings). Each entry is an exact asset key or prefix/* wildcard. Mutated via POST /ci/v1/bindings/{binding_id}/asset-scopes.

github_repository_idstring nullable
created_bystring

Lowercase EVM wallet address.

noncestring
created_sigobject

Parsed delegation: { payload, raw, signer, verified_at }. Stored verbatim for forensic re-verification.

created_atstring date-time
expires_atstring date-time nullable
revoked_atstring date-time nullable
last_used_atstring date-time nullable
use_countinteger

Changes

No recorded changes to this operation across all 1 revision of this API.