Deployment access control

GET /v1/orgs/{orgSlug}/projects/{projectName}/access

Who can reach this deployment. A project that has never set a policy is public, not 404 — most projects are in that state.

The password is never returned on any surface, and a bypass secret is shown only once, when it is created.

Requires viewer or higher.

operationId getAccess

PUT /v1/orgs/{orgSlug}/projects/{projectName}/access

public leaves the deployment open to anyone, org requires member or higher in the org the project belongs to, and password uses one shared password for the whole project. app admits only requests that carry a valid env.auth session for this project; a browser without one is sent to the app's sign-in page and anything else gets 401 sign_in_required. It requires login to be on for the project.

If you don't send a password, the existing one stays. Send a new value to replace it.

Requires admin or higher. Recorded in the audit log as access.set (the password itself is not included).

operationId setAccess

Request body: application/json · object

POST /v1/orgs/{orgSlug}/projects/{projectName}/access/bypass

Use this key to reach a protected deployment from CI or other automation. Send it in the Runlot-Access-Bypass: <secret> request header.

The value appears only in this response. You cannot view it again, and calling this again immediately invalidates the old value — this is how you revoke a leaked secret.

Requires admin or higher. The audit event access.bypass.new does not record the key value.

operationId newAccessBypass

DELETE /v1/orgs/{orgSlug}/projects/{projectName}/access/bypass

Returns 204 even if there is no bypass key. The access policy itself does not change — the bypass key is managed separately from the policy. Requires admin or higher. Recorded in the audit log as access.bypass.revoke.

operationId revokeAccessBypass

POST /v1/access/authorize

Part of the login round trip for a protected deployment. When a visitor is sent back to the dashboard's /access/authorize screen, that screen calls this with their session and then follows the returned redirect, which sets the access cookie on the deployment's own origin.

to must be a hostname runlot knows. If it isn't, this returns 404. next accepts a path only — //evil.example is read as an absolute address and is rejected.

Someone outside the org gets 403, and signing in again returns the same result.

Requires viewer or higher.

operationId authorizeAccess

Request body: application/json · object