List repositories owned by the given handle

GET/api/owners/{handle}/repos

listOwnerRepos

Returns the repos in the resolved owner's workspace that the caller can read, in `sort` order (`updated` by default). Keyset-paginated: pass a previous response's `next_cursor` back as `cursor`, with the same `q`, `sort`, `type` and `language`, for the next page. `q` narrows to slugs containing it, case-insensitively; `type` and `language` narrow further. The first page also lists the primary languages of every repo the caller can read here. Without `sort`, a `cursor` continues in the order it was issued for. A malformed `cursor`, a `cursor` from another explicit `sort`, or a `q` or `language` holding a NUL, is a 400.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/owners/HANDLE/repos'

fetch

fetch("https://neosource.dev/api/owners/HANDLE/repos", {
  method: "GET",
});

Path parameters

handlerequired: Handle of the owner — either a user account or an organization.
string

Query parameters

q: Case-insensitive substring of the repository slug. Matched literally: `%` and `_` are not wildcards.
string
cursor: Opaque pagination cursor from a previous response's `next_cursor`.
string
limit: Page size; default 50, max 100.
integerint64
default50
sort: Ordering: `updated` (the default) is most recently updated first, `name` is slug ascending, `stars` is most stars first. Ties break on slug ascending.
OwnerRepoSort
string
The ordering `GET /api/owners/{handle}/repos` serves (NEO-35). A closed set on the wire, like [`ExploreSort`]. Every order ends in `slug ASC`, which is unique among a workspace's live repos, so each one is total and keyset-pageable.
"updated""name""stars"
type: Narrow by provenance (`sources`: neither a fork nor a mirror, `forks`, `mirrors`) or visibility (`public`, `internal`, `private`). `all`, the default, narrows nothing.
OwnerRepoType
string
The kind narrowing `GET /api/owners/{handle}/repos` serves: one dropdown mixing provenance and visibility, as GitHub's Type filter does. Every value narrows on top of the read decision, never in place of it.
"all""sources""forks""mirrors""public""internal""private"
language: Only repositories whose `primary_language` is exactly this.
string

Responses

200Repository list

application/json

OwnerRepoListResponse

object

`GET /api/owners/{handle}/repos` — one page of the owner's repositories the caller can read, in the requested `sort` order. `repos` is exactly [`RepoListResponse`]'s row shape, every row with its `star_count`. `next_cursor` is an opaque token to pass back as `cursor` (with the same `q`, `sort`, `type` and `language`) for the next page, `null` when the list is exhausted.

languages

array | null

The primary languages of the owner's repositories the caller can read, most repositories first: the options of a language filter. Present on the first page only (no `cursor`), and not narrowed by `q`, `type` or `language`, so choosing one keeps the others listed.

items

OwnerRepoLanguage

object

One entry of [`OwnerRepoListResponse::languages`].

namerequired: string
The language name, as `RepoResponse.primary_language` spells it.
repo_countrequired: integerint64
How many of the caller's readable repositories have it as primary.

next_cursor

string | null

reposrequired

array

items

RepoResponse

object

activity_at: integer | nullint64
When the repo last changed, as the owner list sorts and shows it (ms since the epoch): the later of `updated_at` (a settings write) and its last push. Present only on `GET /api/owners/{handle}/repos` rows, whose statement reads it; absent (not `null`) everywhere else. Set only through [`RepoResponse::with_activity_at`].
allowed_merge_methodsrequired: array
Which merge methods this repo permits at all. Never empty, and always in a canonical order (`merge` before `squash`) — it is a set, so the server normalises the order on write rather than echoing the order it was sent.
itemsMergeMethod
created_atrequired: integerint64
created_byrequired: string
default_branchrequired: string
default_merge_methodrequired: MergeMethod
delete_branch_on_mergerequired: boolean
Whether merging a PR against this repo also deletes its source branch. `true` on a repo nobody has configured — see the settings route for why this one defaults on where the merge-method fields default to today's behaviour.
descriptionrequired: string
mirror_source_url: string | null
mirror_status: one of
RepoMirrorStatus
null
ownerrequired: string
parent: one of
RepoParentInfo
null
primary_language: string | null
The default branch's primary language: the language with the most code lines in the stored breakdown (ADR 0105, ADR 0187). Absent until a fill under the current classification policy has run, and for a repo with no code. An open vocabulary (tokei's names), like `LanguageStat::name`.
repo_idrequired: string
slugrequired: string
star_count: integer | nullint64
All-time star count. Present on exactly four routes — `GET /api/user/stars`, `GET /api/users/{handle}/stars`, `GET /api/repos?sort=trending` and `GET /api/owners/{handle}/repos` — whose store reads carry the count in the same statement. Absent (not `null`) everywhere else, including the default `GET /api/repos`: the repo detail's `stats.star_count` is the per-repo source. Set only through [`RepoResponse::with_star_count`].
statusrequired: RepoStatusOutput
updated_atrequired: integerint64
versionrequired: integerint32
visibilityrequired: RepoVisibilityInput
workspace_idrequired: string

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when a classic OAuth token is asked for something its granted scopes do not cover — an explicit private listing without `repo`, or the one-click GitHub mirror without `admin:public_key`. `scope` names the missing grant so the client can say exactly what the token lacks. There is no elevation route to widen it any more (a re-link goes through the GitHub App, whose tokens carry no scopes), so the client's answer is to say so, never to start a handshake.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
404Not Found — one of: not_found
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget

Schemas

Referenced above. Listed here rather than expanded inline, so the same definition is not repeated at every level.

`MergeMethod`

string

How a pull request's commits land on its target branch. A repo carries two settings over this enum (`migrations/20260820120000_repo_merge_methods.sql`): the set it *permits* (`RepoRecord::allowed_merge_methods`, never empty) and the one the merge path reaches for when the request names none (`RepoRecord::default_merge_method`, always a member of that set — enforced by the settings route, which is the only place both columns are visible at once). `Default` is [`MergeMethod::Merge`] to match the column default, which is itself the pre-existing behaviour of every repo: before this setting existed, a merge always minted a two-parent commit. `Rebase` is deliberately absent rather than merely unimplemented — it replays N commits, can conflict per commit, and rewrites the SHAs the stacked-PR re-parent invariant leans on (`plans/archive/pr-merge-methods-2026-08.md` §"Not doing"). Adding it later is one `ALTER TYPE merge_method ADD VALUE` plus an arm here, which is why the stored shape is an enum array and not a pair of booleans.

"merge""squash"

`RepoMirrorStatus`

object

[`RepoResponse::mirror_status`]: how current a `_mirror` repository is.

last_synced_at: integer | nullint64
When the daily refresh last synced from the upstream (ms since the epoch); absent before the first sync.
latest_ci: one of
CommitStatusState
string
State of a single commit status, GitHub-shaped. `Error` is distinct from `Failure` on individual statuses (infrastructure/tooling breakage vs. a real red result) but the combined rollup folds both into `Failure`.
"pending""success""failure""error"
null

`RepoParentInfo`

object

Summary of a fork's parent repository.

repo_idrequired: string

`RepoStatusOutput`

string

Repo lifecycle state surfaced by the API. Mirrors `RepoStatus`. See ADR 0012 §2.

"creating""ready""importing""import_failed"

`RepoVisibilityInput`

string

"public""internal""private"