Overview

The public API gives scripts, dashboards and CI steps the same data you see in Depos: your repositories, the packages they use, and the allowlist result of any package. It is read only for now.

Every endpoint lives under:

https://<your-depos-host>/api/public/v1/

See Endpoints for each one.

API keys

An admin adds keys under Settings → API → Add API key:

• Name: what uses it, for example CI · allowlist check.
• Access: Read only, or Read and write. The API has no endpoint that changes data yet; choose Read and write only for a script that will need one.
• Expiration: 30 days, 90 days, a year, or never.

The key is shown once. Store it as a secret, for example in your CI's secret store as DEPOS_API_KEY.

A key belongs to the organization it was added in: every call answers for that organization, so you never pass an organization id. It acts as the admin who added it, so:

• it stops working when that person leaves the organization or their account is deleted;
• a Read and write key only reads while that person is not an admin;
• revoking a key stops it at once.

Every member sees the list of keys, who added each one and when it was last used. Adding and revoking a key shows in Activity.

An API key works only on the public API, and an MCP key only on the MCP server for AI agents (AI agents). Using one in the other's place answers 403.

Authentication

Send the key in the X-API-Key header:

curl -H "X-API-Key: $DEPOS_API_KEY" \
  "https://<your-depos-host>/api/public/v1/repositories"

or as a Bearer token:

curl -H "Authorization: Bearer $DEPOS_API_KEY" \
  "https://<your-depos-host>/api/public/v1/repositories"

Lists and pagination

Lists answer in one envelope:

{ "data": [], "total": 0, "page": 1, "pageSize": 25 }

Flags such as violations take true or false (1 and 0 work too). An unknown value answers 400 rather than being ignored.

Ids are the same as in Depos's own URLs: a repository's id is the last part of its page's address.

Rate limits

Each key may make 200 requests a minute. Every answer carries:

Past the limit the answer is 429 with a Retry-After header, in seconds.

Errors

An error answers a JSON body whose data.code is stable, for your code to check, and whose message is for people:

{ "statusCode": 404, "message": "Repository not found.", "data": { "code": "NOT_FOUND" } }