List releases

GET/api/repos/{owner}/{repo}/releases

listRepositoryReleases

Returns the repository's releases, newest first, each with its assets in filename order. Drafts appear only for a caller with repository write access.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/repos/OWNER/REPO/releases'

fetch

fetch("https://neosource.dev/api/repos/OWNER/REPO/releases", {
  method: "GET",
});

Path parameters

ownerrequired: Repository owner or organization slug.
string
reporequired: Repository name.
string

Responses

200Release list

application/json

ReleaseListResponse

object

A repository's releases, newest first. Drafts appear only for a caller with repo Write.

releasesrequired

array

items

ReleaseResponse

object

One release. `assets` is always present: every uploaded asset of the release, in filename order, each with its size and SHA-256 (empty when none has been uploaded).

assetsrequired: array
itemsReleaseAssetResponse
body: string | null
Release notes, markdown. Rendered by the client.
created_atrequired: integerint64
Unix millis.
created_by: string | null
Account that created the release, or `null` when a service token did.
draftrequired: boolean
A draft is visible only to a caller with repo Write.
name: string | null
prereleaserequired: boolean
published_at: integer | nullint64
Unix millis; `null` while the release is a draft. This is what `latest` orders by, and it is set once and never moved.
release_idrequired: string
rollingrequired: boolean
A mutable pointer — at most one per repository, and it never resolves as `latest`.
tagrequired: string
The git tag this release names, case-preserved (`v1.0-RC1` is not `v1.0-rc1`).
example"v1.2.0"
target_commitrequired: string
40-char hex of the commit the tag peeled to when the release was created. Fixed at creation: a later retag does not move it.
updated_atrequired: integerint64
Unix millis.
workflow_run_id: string | null
The CI run that published it, when a job did (Phase 2).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
403Forbidden — one of: forbidden
404Not Found — one of: not_found
423Locked — one of: busy
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget

Schemas

Referenced above. Listed here rather than expanded inline, so the same definition is not repeated at every level.

`ReleaseAssetResponse`

object

One downloadable file attached to a release.

asset_idrequired: string
content_sha256required: string
Lower-case hex SHA-256 of the file's bytes.
content_typerequired: string
download_url: string | null
Where to fetch the bytes. **Always `null` in Phase 1 and 2** — the public download surface, and the signed URL it mints, land in Phase 3.
filenamerequired: string
The name the file downloads as. Never a path: separators, a leading dot and control bytes are refused at creation.
example"neo-linux-x86_64.tar.gz"
size_bytesrequired: integerint64
uploaded_atrequired: integerint64
Unix millis.
uploaded_by_jobrequired: boolean
True when a CI job token published the asset rather than a person.