---
title: "Verify GitLab access"
method: POST
path: "/gitlab-integration/verify"
tags: ["GitLab"]
---

# Verify GitLab access

`POST /gitlab-integration/verify`

## Request

- Base URL: `https://cloud.kaneo.app/api`
- URL: `https://cloud.kaneo.app/api/gitlab-integration/verify`
- Auth: HTTP bearer

Check that the base URL is a GitLab instance and that the token can reach the project with the permissions Kaneo needs. An unreachable instance, a missing project, or insufficient permissions are reported in a 200 body so the form can explain them; a token GitLab rejects outright is a 401.

## Request body

- object
  - `projectId` string, required
  - `baseUrl` string, uri, required
  - `accessToken` string, required
  - `tokenType` 'private' | 'bearer': `private` sends the token in PRIVATE-TOKEN, which is what personal, project and group access tokens expect. `bearer` sends it in Authorization, for an OAuth2 token you already hold. Defaults to `private`.
  - `projectPath` string, required: Full path of the GitLab project, including any nested groups, for example acme/platform/web.

## Response `200`

Verification result

- GitlabVerificationResult
  - `isInstalled` boolean, required: The base URL answered as a GitLab instance for this token.
  - `hasRequiredPermissions` boolean, required
  - `projectExists` boolean, required
  - `projectVisibility` string, nullable, required
  - `missingPermissions` string[], required
  - `message` string, required: A human-readable summary to show the user.
  - `failureReason` 'not_a_gitlab_instance' | 'redirected' | 'project_not_found' | 'null', nullable, required: Why verification failed, when it did. `redirected` usually means the base URL is behind a proxy that rewrites it.

## Other responses

- `400`: Invalid body
- `401`: GitLab rejected the token
- `403`: No access to the project, or missing workspace:manage_settings
- `404`: Project not found
- `429`: The API key exceeded its rate limit or usage quota. Wait the number of seconds in Retry-After before retrying. The X-RateLimit headers are sent only when the rate limit was hit.

## Changes

- **2026-10-09** `c9984766c765`: 1 info
  - added the non-success response with the status `404`
- **2026-10-08** `c7b8a842601b`: 4 breaking, 4 info
  - removed the media type `text/plain` for the response with the status `400`
  - removed the media type `text/plain` for the response with the status `401`
  - removed the media type `text/plain` for the response with the status `403`
  - removed the media type `text/plain` for the response with the status `429`
  - …4 more
- **2026-10-08** `2ed51b8af657`: 3 breaking, 4 info
  - removed the media type `application/json` for the response with the status `400`
  - removed the media type `application/json` for the response with the status `401`
  - removed the media type `application/json` for the response with the status `403`
  - added the media type `text/plain` for the response with the status `400`
  - …3 more
- **2026-10-07** `df1439c724ee`: 3 breaking, 3 info
  - removed the media type `text/plain` for the response with the status `400`
  - removed the media type `text/plain` for the response with the status `401`
  - removed the media type `text/plain` for the response with the status `403`
  - added the media type `application/json` for the response with the status `400`
  - …2 more
- **2026-09-26** `cfcd17ccaa21`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/usekaneo/apis/kaneo-api/changes/gitlab-integration/verify/post.md)

---

[API](https://skmtc.dev/usekaneo/apis/kaneo-api.md) - [All operations](https://skmtc.dev/usekaneo/apis/kaneo-api/llms.txt) - [OpenAPI document](https://skmtc.dev/usekaneo/apis/kaneo-api/revisions/93f78789100c?raw)