POST /v1/source-snapshots

Create source snapshot. Permissions, parameters, responses and examples.

0.1.0 · source bccff29 · Immutable snapshot · Download OpenAPI specification

Read pinned handler: apps/api/kodesec_api/main.py:4157

Create source snapshot

Admit one explicit native-Windows source snapshot without widening mounts.

Source preview; no stable third-party integration promise. This page makes no request to a local installation.

Authority

Browser operator session or exact IDE capability with source:snapshot. Route-specific ownership and generation checks also apply.

Browser mutations require the exact control Origin and session-bound CSRF header. IDE callers use only their admitted route scope and exact generation.

Inspect the authority source · Authentication guide

Parameters and headers

Name	Location	Contract
`X-CSRF-Token`	header Conditional / optional	Required for browser mutations with the exact control Origin. Not an IDE capability. Schema `{ "type": "string" }`
`Content-Length`	header Required	One exact encoded-body byte count, maximum 112 MiB. Schema `{ "maximum": 117440512, "minimum": 0, "type": "integer" }`

Request body

JSON body · required · SourceSnapshotCreate

Field	Type	Presence
`directory_scope`	string \| null	Optional
`files`	array	Required
`name`	string	Required
`source_id`	string	Required

Complete declared request schema

{
  "additionalProperties": false,
  "description": "Explicit bounded source material admitted only by the snapshot route.",
  "properties": {
    "directory_scope": {
      "anyOf": [
        {
          "maxLength": 4096,
          "minLength": 1,
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Directory Scope"
    },
    "files": {
      "items": {
        "$ref": "#/components/schemas/SourceSnapshotFile"
      },
      "maxItems": 5000,
      "title": "Files",
      "type": "array"
    },
    "name": {
      "maxLength": 120,
      "minLength": 1,
      "title": "Name",
      "type": "string"
    },
    "source_id": {
      "pattern": "^[0-9a-f]{64}$",
      "title": "Source Id",
      "type": "string"
    }
  },
  "required": [
    "source_id",
    "name",
    "files"
  ],
  "title": "SourceSnapshotCreate",
  "type": "object"
}

Responses

Status	Meaning and declared shape
`201`	Successful Response application/json · SourceSnapshotOut { "properties": { "directory_scope": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "title": "Directory Scope" }, "file_count": { "maximum": 5000, "minimum": 0, "title": "File Count", "type": "integer" }, "project": { "$ref": "#/components/schemas/ProjectOut" }, "snapshot_digest": { "pattern": "^[0-9a-f]{64}$", "title": "Snapshot Digest", "type": "string" }, "total_bytes": { "maximum": 67108864, "minimum": 0, "title": "Total Bytes", "type": "integer" } }, "required": [ "project", "snapshot_digest", "directory_scope", "file_count", "total_bytes" ], "title": "SourceSnapshotOut", "type": "object" }
`400`	Exact host, malformed request or URL credential refusal application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`401`	Missing or invalid membership application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`403`	Exact origin, CSRF or route authority refusal application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`422`	Validation Error application/json · HTTPValidationError `{ "properties": { "detail": { "items": { "$ref": "#/components/schemas/ValidationError" }, "title": "Detail", "type": "array" } }, "title": "HTTPValidationError", "type": "object" }`
`429`	Authentication rate or connection limit application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`503`	Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness. See source-linked error catalog.

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

3 source error observations

Status	Source detail	Recovery
422 ↗	`Dynamic detail; inspect source`	Correct the field or semantic validation error. Input values are omitted from control validation errors.
503 ↗	`Dynamic detail; inspect source`	Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness.
503 ↗	`Dynamic detail; inspect source`	Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Request JSON

{
  "files": [],
  "name": "Synthetic demo",
  "source_id": "0000000000000000000000000000000000000000000000000000000000000000"
}

Response 201 JSON

{
  "directory_scope": "synthetic",
  "file_count": 1,
  "project": {
    "created_at": "2026-01-01T00:00:00Z",
    "default_branch": "synthetic",
    "id": 1,
    "name": "Synthetic demo",
    "remote_url": "synthetic",
    "repo_path": "/workspace/synthetic-demo"
  },
  "snapshot_digest": "0000000000000000000000000000000000000000000000000000000000000000",
  "total_bytes": 1
}

Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.