Mirror to GitHub in one click

POST/api/repos/{owner}/{repo}/mirrors/github

createGithubMirror

One-click 'keep GitHub as a backup': creates a GitHub-targeted push mirror with no manual key paste. Requires repo admin. When the neosource GitHub App is installed on the target — on an installation you connected, or your organisation's — with `contents` and `workflows` write, the mirror pushes through that installation (`credential: github_app`; no deploy key is registered). If such an installation reaches the repo but lacks a permission, `403 github_app_permission_missing` (body `GithubAppPermissionMissingError`) names the missing permissions and the installation page to accept them on. Otherwise a linked identity holding a GitHub **App** user-to-server token gets `403 github_app_install_required` (its `message` carries the install URL), and a classic OAuth token falls back to registering the mirror's deploy key (`credential: deploy_key`), which needs the `admin:public_key` scope — `403` `NeedsScopeError` when it is missing. On a deployment with no GitHub App configured, an App identity gets `403 github_mirror_unavailable_for_app_identity`. A target that is the repository's own GitHub upstream is refused with `409 relationship_conflict` while the repository still pulls from it (move it to neosource first: `POST …/github-detach`), and otherwise with `409 conflict` unless `acknowledge_replica_overwrite` is set; a second mirror to the same GitHub repository is `409 conflict`.

Requires authentication using a bearer token or a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/repos/OWNER/REPO/mirrors/github' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"github_full_name":"string"}'

fetch

fetch("https://neosource.dev/api/repos/OWNER/REPO/mirrors/github", {
  method: "POST",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"github_full_name":"string"}),
});

Path parameters

ownerrequired: Repository owner or organization slug.
string
reporequired: Repository name.
string

Request bodyrequired

application/json

CreateGithubMirrorRequest

object

Request for the one-click "mirror to GitHub" flow (plans/github-onboarding-tiers.md, E.1; ADR 0122). Creates a GitHub-targeted mirror that pushes through the neosource GitHub App when an installation the caller may use covers the repository, and otherwise auto-registers its deploy key on GitHub using the caller's classic OAuth token (requires the `admin:public_key` scope — a `403` `NeedsScopeError` names the missing scope; there is no elevation).

acknowledge_replica_overwrite: boolean
Acknowledge that a mirror **replicates exactly**: it force-updates refs on the target and deletes any it has that this repo does not. Required (ADR 0107 D6) only when the target is this repo's own GitHub upstream — the repo it was imported from. That combination is refused with `409` unless this is `true`, because the same action is either "keep GitHub as a backup now that I work here" or "destroy the work still happening on GitHub", and only the caller knows which. Defaults to `false`. While the repo still syncs from that upstream (relationship `github_managed` or `neosource_readonly_mirror`) the combination is refused with `409` even when this is `true` (ADR 0166): move the repository to neosource first (`POST …/github-detach`).
github_full_namerequired: string
The GitHub `owner/name` to mirror to.

Responses

201Mirror created — pushing through the GitHub App, or with a deploy key registered on GitHub

application/json

MirrorResponse

object

acknowledged_replicarequired: boolean
Whether the creator acknowledged exact-replica semantics. Surfaced so the UI can explain why a mirror aimed at this repo's upstream is not pushing (ADR 0107 D6) rather than showing an unexplained `last_error`.
created_atrequired: integerint64
credentialrequired: MirrorCredentialKind
string
The closed set of mirror credential kinds, as the API reports them. The installation and repository ids stay server-side.
"deploy_key""github_app"
last_error: string | null
last_error_at: integer | nullint64
last_synced_at: integer | nullint64
last_synced_op_id: string | null
Hex-encoded operation ID of the last successful push, or null.
mirror_idrequired: string
repo_idrequired: string
ssh_public_keyrequired: string
OpenSSH-format public key. Paste this as a deploy key on the upstream side. Always present in responses — the private key stays in the database.
target_kindrequired: MirrorTargetKind
string
What kind of upstream a mirror is targeting. Persisted as the `mirror_target_kind` Postgres enum.
"github""gitlab""generic"
target_urlrequired: string

403Forbidden — one of: forbidden, needs_scope, github_app_install_required, github_app_permission_missing, github_mirror_unavailable_for_app_identity

application/json

one of

ErrorForbiddenOrGithubAppInstallRequiredOrGithubAppPermissionMissingOrGithubMirrorUnavailableForAppIdentity
NeedsScopeError
object
`403` body returned when a classic OAuth token is asked for something its granted scopes do not cover — an explicit private listing without `repo`, or the one-click GitHub mirror without `admin:public_key`. `scope` names the missing grant so the client can say exactly what the token lacks. There is no elevation route to widen it any more (a re-link goes through the GitHub App, whose tokens carry no scopes), so the client's answer is to say so, never to start a handshake.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
404Not Found — one of: not_found
409Conflict — one of: already_exists, conflict, relationship_conflict
423Locked — one of: busy
429Rate limited — retry after the `Retry-After` header
500Internal server error
502Bad Gateway — one of: upstream
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget