API reference
Tasuku API authentication, error envelopes, pagination, and generated endpoint documentation.
The versioned control-plane API is served under:
/api/v1The generated endpoint pages in this section come directly from api/openapi.yaml during the static documentation build. They are read-only documentation: this site does not proxy requests or forward browser cookies or tokens.
Spec generation
api/openapi.yaml is the committed API contract this site, and the dashboard's generated client (openapi-typescript), both build from. During the Cloudflare rewrite it is generated per route group as each is ported: server/scripts/generate-openapi.ts writes it from the Hono routes' @hono/zod-openapi schemas with bun run api:generate, reusing the same operationIds, tags, and component names the previous Go-derived spec used, so this section's page structure and the dashboard's typed client keep working unchanged through the migration. CI fails on drift between the checked-in api/openapi.yaml and what api:generate would produce.
Authentication
The bootstrap endpoints use a bearer TASUKU_BOOTSTRAP_TOKEN during initial setup and, before the first user exists, GitHub App manifest registration. Browser manifest authorization is exchanged for an HttpOnly cookie that expires after five minutes.
Authenticated product endpoints accept the active session cookie (__Host-tasuku_session in production). The contract also describes bearer session use where supported. Authorization remains organization-scoped and role/capability checked.
Errors
API errors use a stable machine-readable code and human-readable message in the documented error envelope. Treat the code as the programmatic branch and the message as operator context.
Common status meanings:
| Status | Meaning |
|---|---|
400 | Invalid input, cursor, provider configuration, or workflow command. |
401 | Missing, expired, revoked, or invalid authentication. |
403 | Authenticated user lacks the required role or capability. |
404 | Organization-scoped resource is absent or inaccessible. |
409 | State conflict, duplicate operation, or protected last-super-user change. |
Pagination
List endpoints that can grow use cursor pagination. Pass the returned cursor to request the next page and keep the documented page size within its limit. Cursors are opaque; do not parse or construct them.
Endpoint groups
The generated reference groups every operation in api/openapi.yaml by tag:
- Bootstrap
- Authentication
- Organizations
- Users
- GitHub
- Connected Apps
- Slack
- Linear
- Configuration
- Workflows
- Work Items
- Memories
- Repositories
- Secrets
- OpenCode
- Reviews
- Deep Scans
Use the sidebar or search to open a generated operation. Request examples are illustrative and do not execute from this static site.