API reference

Conventions

• Base URL. All endpoints are relative to https://app.infiniview.dev.
• Content type. Request and response bodies are JSON unless the endpoint advertises another type — CSV exports return text/csv, live progress streams return text/event-stream.
• Authentication. Endpoints use the dashboard session cookie. Two endpoints are public: GET /api/health and POST /api/validate-infiniview-yml.
• Idempotency. Mutations are not idempotent unless an endpoint says so. The GitHub webhook receiver deduplicates by X-GitHub-Delivery.
• Timestamps. ISO 8601 in UTC, ending with Z.

Errors

Error responses share a single shape. The code is stable, the message is human-readable, and details may carry field-level validation errors.

{
  "error": {
    "code": "validation_failed",
    "message": "Invalid request body.",
    "details": {
      "branch": ["must be a non-empty string"]
    }
  }
}

Pagination

List endpoints accept ?page (1-indexed) and ?perPage. Defaults and caps vary by endpoint:

Responses include page, perPage, total, and a hasMore flag where applicable.

Rate limits

Limits are per signed-in user, per route bucket. When a bucket is exhausted, the API returns 429 with a Retry-After header containing the number of seconds before another request will succeed. Bucketed endpoints are flagged in the tables below — anything without a rate-limit note shares the global account quota.

• 5/60s — review creation, billing checkout.
• 10/60s — reruns, repo-secret writes, suppression deletes.