Create a push-only mirror

POST/api/repos/{owner}/{repo}/mirrors

createMirror

Configures a new mirror that pushes to GitHub, GitLab, or any SSH-reachable git host. Returns the mirror's SSH public key — paste it as a deploy key on the upstream side to grant push access. Requires admin access on the repo.

Requires authentication using a bearer token or a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/repos/OWNER/REPO/mirrors' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"target_url":"string","target_kind":"string"}'

fetch

fetch("https://neosource.dev/api/repos/OWNER/REPO/mirrors", {
  method: "POST",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"target_url":"string","target_kind":"string"}),
});

Path parameters

ownerrequired: Repository owner or organization slug.
string
reporequired: Repository name.
string

Request bodyrequired

application/json

CreateMirrorRequest

object

acknowledge_replica_overwrite: boolean
Acknowledge that a mirror **replicates exactly**: it force-updates refs on the target and deletes any it has that this repo does not. Required (ADR 0107 D6) only when the target is this repo's own GitHub upstream — the repo it was imported from. That combination is refused with `409` unless this is `true`, because the same action is either "keep GitHub as a backup now that I work here" or "destroy the work still happening on GitHub", and only the caller knows which. Defaults to `false`.
target_kindrequired: MirrorTargetKind
string
What kind of upstream a mirror is targeting. Persisted as the `mirror_target_kind` Postgres enum.
"github""gitlab""generic"
target_urlrequired: string
SSH target URL (e.g. `git@github.com:owner/repo.git` or `ssh://git@github.com/owner/repo.git`). HTTPS URLs are rejected — mirroring uses a per-mirror SSH deploy key.

Responses

201Mirror created

application/json

MirrorResponse

object

acknowledged_replicarequired: boolean
Whether the creator acknowledged exact-replica semantics. Surfaced so the UI can explain why a mirror aimed at this repo's upstream is not pushing (ADR 0107 D6) rather than showing an unexplained `last_error`.
created_atrequired: integerint64
last_error: string | null
last_error_at: integer | nullint64
last_synced_at: integer | nullint64
last_synced_op_id: string | null
Hex-encoded operation ID of the last successful push, or null.
mirror_idrequired: string
repo_idrequired: string
ssh_public_keyrequired: string
OpenSSH-format public key. Paste this as a deploy key on the upstream side. Always present in responses — the private key stays in the database.
target_kindrequired: MirrorTargetKind
string
What kind of upstream a mirror is targeting. Persisted as the `mirror_target_kind` Postgres enum.
"github""gitlab""generic"
target_urlrequired: string

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
403Forbidden — one of: forbidden
404Not Found — one of: not_found
409Conflict — one of: already_exists, conflict, non_fast_forward
423Locked — one of: busy
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget