Lomo CodeSecurity

The API reference is in English.

Current source preview reference

POST /v1/git/push-protection/{repository_id}/trees

Upload git tree. Permissions, parameters, responses and examples.

0.1.0 · source bccff29 · Immutable snapshot · Download OpenAPI specification

Read pinned handler: apps/api/kodesec_api/git_push_evidence.py:179

Upload git tree

Upload git tree through POST /v1/git/push-protection/{repository_id}/trees. The parameters and declared response shapes below come from this exact source snapshot.

Source preview; no stable third-party integration promise. This page makes no request to a local installation.

Authority

Browser operator session or exact IDE capability with project:resolve. Route-specific ownership and generation checks also apply.

Browser mutations require the exact control Origin and session-bound CSRF header. IDE callers use only their admitted route scope and exact generation.

Inspect the authority source · Authentication guide

Parameters and headers

NameLocationContract
repository_idpath
Required

string

Schema
{
  "title": "Repository Id",
  "type": "string"
}
X-CSRF-Tokenheader
Conditional / optional

Required for browser mutations with the exact control Origin. Not an IDE capability.

Schema
{
  "type": "string"
}
Content-Lengthheader
Required

One exact encoded-body byte count, maximum 112 MiB.

Schema
{
  "maximum": 117440512,
  "minimum": 0,
  "type": "integer"
}

Request body

JSON body · required · GitTreeUpload

FieldTypePresence
filesarrayRequired
object_formatstringRequired
tree_oidstringRequired
Complete declared request schema
{
  "additionalProperties": false,
  "properties": {
    "files": {
      "items": {
        "$ref": "#/components/schemas/GitTreeFile"
      },
      "maxItems": 5000,
      "title": "Files",
      "type": "array"
    },
    "object_format": {
      "enum": [
        "sha1",
        "sha256"
      ],
      "title": "Object Format",
      "type": "string"
    },
    "tree_oid": {
      "pattern": "^(?:[0-9a-f]{40}|[0-9a-f]{64})$",
      "title": "Tree Oid",
      "type": "string"
    }
  },
  "required": [
    "object_format",
    "tree_oid",
    "files"
  ],
  "title": "GitTreeUpload",
  "type": "object"
}

Responses

StatusMeaning and declared shape
201

Successful Response

application/json · object
{
  "additionalProperties": true,
  "title": "Response Upload Git Tree V1 Git Push Protection  Repository Id  Trees Post",
  "type": "object"
}
400

Exact host, malformed request or URL credential refusal

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
401

Missing or invalid membership

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
403

Exact origin, CSRF or route authority refusal

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
409

Refresh current revision and identity. A conflicting command must not be blindly repeated. See source-linked error catalog.

422

Validation Error

application/json · HTTPValidationError
{
  "properties": {
    "detail": {
      "items": {
        "$ref": "#/components/schemas/ValidationError"
      },
      "title": "Detail",
      "type": "array"
    }
  },
  "title": "HTTPValidationError",
  "type": "object"
}
429

Authentication rate or connection limit

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

9 source error observations
StatusSource detailRecovery
409 ↗{"code":"push_project_unavailable","message":"The registered source project was removed. Review this repository's protection before creating more scan data."}Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗{"code":"push_tree_binding_changed","message":"The immutable Git tree's stored source binding changed. Review it before scanning."}Refresh current revision and identity. A conflicting command must not be blindly repeated.
422 ↗{"code":"push_tree_invalid","message":"Uploaded files do not cover the complete immutable Git tree."}Correct the field or semantic validation error. Input values are omitted from control validation errors.
422 ↗{"code":"push_tree_invalid","message":"Immutable Git file bytes do not match their declared identity."}Correct the field or semantic validation error. Input values are omitted from control validation errors.
422 ↗{"code":"push_tree_unsupported","message":"The immutable tree exceeds the supported path depth or metadata bound."}Correct the field or semantic validation error. Input values are omitted from control validation errors.
422 ↗{"code":"push_tree_unsupported","message":"Git administration paths cannot be included in an immutable scan."}Correct the field or semantic validation error. Input values are omitted from control validation errors.
422 ↗{"code":"push_tree_invalid","message":"Immutable Git paths must be unique."}Correct the field or semantic validation error. Input values are omitted from control validation errors.
422 ↗{"code":"push_tree_invalid","message":"An immutable Git file is not valid bounded content."}Correct the field or semantic validation error. Input values are omitted from control validation errors.
422 ↗{"code":"push_tree_invalid","message":"Immutable Git paths overlap a regular file."}Correct the field or semantic validation error. Input values are omitted from control validation errors.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Request JSON
{
  "files": [],
  "object_format": "sha1",
  "tree_oid": "0000000000000000000000000000000000000000"
}
Response 201 JSON
{}
Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.