Mirror to GitHub with an auto-registered deploy key

POST/api/repos/{owner}/{repo}/mirrors/github

createGithubMirror

One-click 'keep GitHub as a backup': creates a GitHub-targeted push mirror and registers its deploy key on the GitHub repo using your linked GitHub account — no manual key paste. Requires repo admin AND a GitHub identity with the `admin:public_key` scope; returns `403` `NeedsScopeError` (scope `admin:public_key`) when the scope is missing so the UI can elevate.

Requires authentication using a bearer token or a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/repos/OWNER/REPO/mirrors/github' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"github_full_name":"string"}'

fetch

fetch("https://neosource.dev/api/repos/OWNER/REPO/mirrors/github", {
  method: "POST",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"github_full_name":"string"}),
});

Path parameters

ownerrequired: Repository owner or organization slug.
string
reporequired: Repository name.
string

Request bodyrequired

application/json

CreateGithubMirrorRequest

object

Request for the one-click "mirror to GitHub" flow (plans/github-onboarding-tiers.md, E.1). Creates a GitHub-targeted mirror and auto-registers its deploy key on GitHub using the caller's OAuth token (requires the `admin:public_key` scope — a `403` `NeedsScopeError` prompts the SPA to elevate).

acknowledge_replica_overwrite: boolean
Acknowledge that a mirror **replicates exactly**: it force-updates refs on the target and deletes any it has that this repo does not. Required (ADR 0107 D6) only when the target is this repo's own GitHub upstream — the repo it was imported from. That combination is refused with `409` unless this is `true`, because the same action is either "keep GitHub as a backup now that I work here" or "destroy the work still happening on GitHub", and only the caller knows which. Defaults to `false`.
github_full_namerequired: string
The GitHub `owner/name` to mirror to.

Responses

201Mirror created + deploy key registered

application/json

MirrorResponse

object

acknowledged_replicarequired: boolean
Whether the creator acknowledged exact-replica semantics. Surfaced so the UI can explain why a mirror aimed at this repo's upstream is not pushing (ADR 0107 D6) rather than showing an unexplained `last_error`.
created_atrequired: integerint64
last_error: string | null
last_error_at: integer | nullint64
last_synced_at: integer | nullint64
last_synced_op_id: string | null
Hex-encoded operation ID of the last successful push, or null.
mirror_idrequired: string
repo_idrequired: string
ssh_public_keyrequired: string
OpenSSH-format public key. Paste this as a deploy key on the upstream side. Always present in responses — the private key stays in the database.
target_kindrequired: MirrorTargetKind
string
What kind of upstream a mirror is targeting. Persisted as the `mirror_target_kind` Postgres enum.
"github""gitlab""generic"
target_urlrequired: string

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when listing private repos but the linked identity lacks the required provider scope. The SPA turns this into an incremental-authorization prompt (Tier 2) that calls the `/elevate` OAuth endpoint with this `scope`.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
404Not Found — one of: not_found
409Conflict — one of: already_exists, conflict
423Locked — one of: busy
429Rate limited — retry after the `Retry-After` header
500Internal server error
502Bad Gateway — one of: upstream
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget