Skip to content
Indiana
Dashboard
Docs
Browse docs / Read code-reference scan configuration

Read code-reference scan configuration

POST/api/v1/code-references/config

Merchant CI uses a dedicated code-references:read Key to fetch the bound repository/branch rules, complete feature-key set and digest. The Key fixes the App and environment. No source, Customer data or Key bindings are returned. Fetch current configuration with the CLI; do not reuse the example digest.

API v1Updated

Make the request

Merchant CI uses a dedicated code-references:read Key to fetch the bound repository/branch rules, complete feature-key set and digest. The Key fixes the App and environment. No source, Customer data or Key bindings are returned. Fetch current configuration with the CLI; do not reuse the example digest.

Credential
Server API key only. Call from your trusted backend.
Permission
code-references:read
Set the base URL and App ID from SDK setup. These examples use placeholders and do not execute requests. Never put a server key in browser code.
request.shShell
curl -X POST "$INDIANA_BASE_URL/api/v1/code-references/config" \  -H "Authorization: Bearer $INDIANA_CODE_REFERENCES_KEY" \  -H "X-Indiana-Project: $INDIANA_PROJECT_ID" \  -H "X-Indiana-Protocol: 0.5" \  -H "X-Indiana-Environment: sandbox" \  -H "Content-Type: application/json" \  -d '{  "repositoryId": "00000000-0000-4000-8000-000000000001",  "branch": "main"}'

The response is illustrative, not the result of a live request.

Request parameters

JSON body

repositoryIduuidRequired

The repositoryId value for this operation. Its accepted type and constraints are listed above and below.

branchstringRequired

The branch value for this operation. Its accepted type and constraints are listed above and below.

minLength: 1 · maxLength: 200 · pattern: ^[a-zA-Z0-9_./-]+$

Response fields

Successful responses include requestId and scope. Use the actual business status or accepted field to determine the result. Optional fields are omitted when unavailable.

HTTP 200 · application/json

requestIduuidRequired

Server-generated HTTP request UUID. Include it when reporting a failed request.

scopeobjectRequired

The App and environment of this response. Headers only verify scope; they cannot switch key scope.

Show child fields
projectIdstringRequired

App ID bound to the credential.

minLength: 1

environmentenumRequired

Separate data scope: sandbox or live.

Show allowed values

"sandbox""live"

configobjectRequired

The config value for this operation. Its accepted type and constraints are listed above and below.

Show child fields
repositoryobjectRequired

The repository value for this operation. Its accepted type and constraints are listed above and below.

Show child fields
iduuidRequired

The id value for this operation. Its accepted type and constraints are listed above and below.

repostringRequired

The repo value for this operation. Its accepted type and constraints are listed above and below.

maxLength: 512 · pattern: ^[\w.-]+(?:\/[\w.-]+){1,5}$

platformenumRequired

The platform value for this operation. Its accepted type and constraints are listed above and below.

Show allowed values

"github""gitlab""bitbucket"

branchesarrayRequired

The branches value for this operation. Its accepted type and constraints are listed above and below.

minItems: 1 · maxItems: 4

workflowstringRequired

The workflow value for this operation. Its accepted type and constraints are listed above and below.

pattern: ^\.github\/workflows\/[a-zA-Z0-9_-]+\.ya?ml$

includearrayRequired

Select memberships, entitlements and/or credits; default all, at least one without duplicates. Memberships also needs billing:read and credits needs credits:read; the endpoint always needs entitlements:read.

minItems: 1 · maxItems: 16

excludearrayRequired

The exclude value for this operation. Its accepted type and constraints are listed above and below.

maxItems: 16

methodsarrayRequired

The methods value for this operation. Its accepted type and constraints are listed above and below.

minItems: 1 · maxItems: 32

maxAgeHoursintegerRequired

The maxAgeHours value for this operation. Its accepted type and constraints are listed above and below.

min: 1 · max: 720

revisionintegerRequired

Revision of the specific versioned resource; Customer profile updates have no revision.

max: 9007199254740991

branchstringRequired

The branch value for this operation. Its accepted type and constraints are listed above and below.

minLength: 1 · maxLength: 200 · pattern: ^[a-zA-Z0-9_./-]+$

keysarrayRequired

The keys value for this operation. Its accepted type and constraints are listed above and below.

maxItems: 2000

keySetHashstringRequired

The keySetHash value for this operation. Its accepted type and constraints are listed above and below.

pattern: ^[a-f0-9]{64}$

Handle errors

Common failures
CodeRecovery
UNAUTHENTICATEDVerify the key or refresh the expired customer token once.
FORBIDDENCheck current key permissions and customer access.
INVALID_REQUESTCheck field types, UUIDs, decimal strings and mutually exclusive fields.
SCOPE_MISMATCHUse the App and environment bound to the credential.

Common failures

  • UNAUTHENTICATED

    Recovery
    Verify the key or refresh the expired customer token once.

  • FORBIDDEN

    Recovery
    Check current key permissions and customer access.

  • INVALID_REQUEST

    Recovery
    Check field types, UUIDs, decimal strings and mutually exclusive fields.

  • SCOPE_MISMATCH

    Recovery
    Use the App and environment bound to the credential.

Related:All request and error conventions·Back to endpoint index