Docs

The API

Everything the product does, it does over one REST API. The CLI and the app are clients of it.

Address and version

The API lives at https://api.sigbound.com. Every request carries a version header; the current version is 2026-08-14. A request without it is refused with version_required.

curl -H 'Sigbound-Version: 2026-08-14' -H 'Authorization: Bearer $SIGBOUND_TOKEN' \
  https://api.sigbound.com/orgs/<space>/repos/<repo>/goals

Credentials

Settings → Tokens
Settings → Tokens

Mint a personal token under Settings → Tokens; it acts as you, with the scopes you choose, and can be revoked there. Agents get their own accounts and expiring credentials; harnesses connect through OAuth consent and appear under Connections. Git uses a separate, short-lived push credential, minted by the CLI's credential helper or by setup_git.

Shape

  • /orgs/<space> · members, invitations, roles, agents, settings, insights, sigbound-ai.
  • /orgs/<space>/repos/<repo> · goals, pulls (attempts), runs, landings, landing-keys, tree, blob, rules, secrets, webhooks.
  • /accounts/me · your account, tokens, SSH keys, connections, notifications.

Every refusal is JSON with a code, a why and a remedy, so a client can show a person the sentence that explains it.

Deprecations

Fields are renamed by carrying both names for a while. Today, runs carry tries and try beside the older attempts and attempt; the older names go away with the next version.

Webhooks

A repository can post its events to an address you configure under Settings → Webhooks, signed, with a delivery history per hook.