Documentation

Developer browser API

Understand the session-backed API that powers the signed-in upstream.codes product.

The developer API powers the authenticated upstream.codes dashboard and settings. It is a browser surface, not a general service-token API.

Base path

https://upstream.codes/api/forge/developer

It covers the viewer bootstrap, dashboard, repository index and creation, notifications, preferences, Git credentials, API tokens, SSH keys, CLI sessions, and GitHub Sync.

Authentication boundary

Requests use the Upstream browser session established through the shared Coline identity authority. Mutations also require a same-origin request so another site cannot drive a signed-in browser.

Do not copy the session cookie into a script or CI runner. It is intentionally fail-closed outside the browser flow.

Programmatic alternatives

Use the Upstream CLI for repository and Change Request automation from a terminal or agent.
Use a workspace token with upstream.checks.write to report external checks.
Use the public forge API for anonymous public data.

A broader scoped bearer API for forge mutations is not currently published.