Show a runner enrollment

GET/api/workspaces/{workspace_id}/runner-enrollments/{enrollment_id}

getRunnerEnrollment

One enrollment, if the caller may manage it (see the list). 404 otherwise.

Requires authentication using a bearer token or a session cookie — see tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/workspaces/WORKSPACE_ID/runner-enrollments/ENROLLMENT_ID' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN'

fetch

fetch("https://neosource.dev/api/workspaces/WORKSPACE_ID/runner-enrollments/ENROLLMENT_ID", {
  method: "GET",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
  },
});

Path parameters

workspace_idrequired: string
enrollment_idrequired: string

Responses

200The enrollment

application/json

RunnerEnrollmentResponse

object

One runner enrollment. Never carries the token.

actor_id: string | null
The account actor-bound runners are bound to (always the creator).
bindingrequired: RunnerBindingKind
string
Which trust binding a job executed under (ADR 0056 §1/§7). Serialized on the wire and in `workflow_run_jobs.executed_on` as the `snake_case` strings `hosted` / `workspace` / `actor`.
"hosted""workspace""actor"
created_atrequired: integerint64
created_by_accountrequired: string
The account that created it. Registration re-checks that this account still holds the creating permission.
created_by_token_id: string | null
The token that created it, when one did: registration also needs that token to still be live and to still permit the action.
ephemeralrequired: boolean
expires_at: integer | nullint64
Epoch ms; `null` = never.
idrequired: string
kindrequired: RunnerEnrollmentKind
string
How an enrollment is presented (ADR 0153 §1). Only `Token` is creatable today; `Workload` is the projected-ServiceAccount-token kind, whose columns exist but which no route creates or redeems yet.
"token""workload"
max_uses: integer | nullint32
`null` = unbounded.
revoked_at: integer | nullint64
Epoch ms; `null` = live.
scoperequired: RunnerScope
string
Whether a runner is hosted by the platform (per [ADR 0014]) or long-poll-attached from outside.
"hosted""self_hosted""local"
usesrequired: integerint32
vm_backendsrequired: array
items
VmBackendKind
string
"docker_shell""kata_clh""kata_fc""lib_krun""k8s_runc""cloud_hypervisor"
workspace_id: string | null

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when a classic OAuth token is asked for something its granted scopes do not cover — an explicit private listing without `repo`, or the one-click GitHub mirror without `admin:public_key`. `scope` names the missing grant so the client can say exactly what the token lacks. There is no elevation route to widen it any more (a re-link goes through the GitHub App, whose tokens carry no scopes), so the client's answer is to say so, never to start a handshake.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
404Not Found — one of: not_found
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget