CI Federation

Create a CI binding

Create a binding linking a wallet-signed delegation to a GitHub OIDC subject pattern + project + capability scope. Optional route_scopes delegate narrow Web Routes changes such as /admin and /admin/*; omitted means no route authority. The body's signed_delegation is a SIWE/SIWX-shaped wallet-signed message verified byte-for-byte against canonical Statement and Resources builders (services/ci-bindings.ts). Position-A trust model: deployed function code runs with the project's runtime authority (RUN402_SERVICE_KEY, adminDb(), configured secrets) — disclosed verbatim in the wallet-UI consent text. Out of scope for v1: secrets_set, domain_bind, subdomain_claim, lifecycle/billing/contracts/faucet calls; non-EVM wallets; non-GitHub federation.

post/ci/v1/bindings

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/ci/v1/bindings
  • Auth: API key in header SIGN-IN-WITH-X

Headers

SIGN-IN-WITH-Xstring required

SIWX auth header — base64-encoded JSON payload containing a signed CAIP-122 (EIP-4361) message. See https://docs.x402.org/extensions/sign-in-with-x.

Request body

project_idstring required
provider'github-actions' required
subject_matchstring required

Exact OIDC subject string OR a string ending in a single trailing * wildcard. Matching is string-prefix, NOT regex. Reject: empty, control chars, multiple *, * not at the end, bare *.

allowed_actionsstring[] required
allowed_eventsstring[]

GitHub event_name values allowed. Defaults exclude pull_request and pull_request_target; opt in only deliberately.

route_scopesstring[]

Optional exact or final-wildcard route patterns this CI binding may alter, e.g. [/admin, /admin/*]. Omit for no route authority. Non-null spec.routes in CI is allowed only when all added/removed/changed route entries are within these scopes.

github_repository_idstring nullable

GitHub stable numeric repository ID. When non-NULL, defends against the delete-then-recreate slug-reuse attack. NULL = soft-bound (logged distinctly).

expires_atstring date-time nullable
noncestring required

Lowercase hex 16-64 chars. Must match the nonce inside the signed delegation. Unique per (wallet, nonce) — replay protection enforced by a UNIQUE DB index.

signed_delegationstring required

Base64-encoded SIWE/SIWX-shaped wallet-signed message. The Statement and Resources fields must be verbatim equal to canonical builders' output (drift fails verification).

Response

Binding created

idstring

Binding id, prefixed bnd_.

project_idstring
issuerstring

OIDC issuer URL (FK to internal.trusted_oidc_issuers). v1 only: https://token.actions.githubusercontent.com.

subject_matchstring
allowed_actionsstring[]
allowed_eventsstring[]

Sorted-deduped on insert. Default ['push','workflow_dispatch'].

route_scopesstring[]

Sorted-deduped explicit route patterns CI may alter. Empty array means CI cannot ship non-null spec.routes.

asset_key_scopesstring[] nullable

Per-binding allowlist for the spec.assets slice. NULL means no asset authority (default for bindings created via POST /ci/v1/bindings). Each entry is an exact asset key or prefix/* wildcard. Mutated via POST /ci/v1/bindings/{binding_id}/asset-scopes.

github_repository_idstring nullable
created_bystring

Lowercase EVM wallet address.

noncestring
created_sigobject

Parsed delegation: { payload, raw, signer, verified_at }. Stored verbatim for forensic re-verification.

created_atstring date-time
expires_atstring date-time nullable
revoked_atstring date-time nullable
last_used_atstring date-time nullable
use_countinteger

Changes

No recorded changes to this operation across all 1 revision of this API.