Import a repository from a public git URL

POST/api/imports/url

createUrlImport

Creates a new neosource repository in the workspace named by `owner` (omitted = the caller's personal workspace) and enqueues a background import that clones a PUBLIC git URL into it — no OAuth, provider-agnostic (GitHub, GitLab, Codeberg, self-hosted, …). The URL is validated (https-only, no credentials, host must resolve to a public address) before enqueue. Watch progress via the repo's `import-progress` SSE / `import-status` endpoints. Every target, the caller's personal workspace included, needs `workspace:repo:create` there, decided **before the repository is created**: `404` for an unknown owner, `403` without the permission. A session or an unrestricted token holds it in the caller's personal workspace; a token whose scopes do not cover it, or one locked to other workspaces or to repositories, is refused `403` there too. The import queue is bounded: `429` when the caller already has the per-user maximum of imports queued or running, `503` when the platform-wide queue is full. Both are retryable and carry `Retry-After`, and both land **before the repository is created**.

Requires authentication using a session cookie or a bearer token — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/imports/url' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"clone_url":"string"}'

fetch

fetch("https://neosource.dev/api/imports/url", {
  method: "POST",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"clone_url":"string"}),
});

Request bodyrequired

application/json

CreateUrlImportRequest

object

Request to import a repository from a public git URL into a new neosource repo (`POST /api/imports/url`). Provider-agnostic and OAuth-free — any public HTTPS git host (GitHub, GitLab, Codeberg, a self-hosted Gitea, …) works, because a public repo clones for anyone. The URL is validated server-side (https-only, no embedded credentials, host must resolve to a public address) before the import is enqueued.

clone_urlrequired: string
Public HTTPS git clone URL, e.g. `https://github.com/owner/repo.git`.
owner: string | null
The organization workspace slug to import into. Omitted (or the caller's own handle) = the caller's personal workspace. Every target, the personal workspace included, needs `workspace:repo:create` there, asked of the policy layer before the repository is created.
target_name: string | null
Optional name for the created neosource repo; defaults to the last path segment of the clone URL (with any `.git` suffix stripped).
visibility: one of
RepoVisibilityInput
string
"public""internal""private"
null

additional propertiesnot allowed

Responses

202Repo created and import enqueued

application/json

ImportEnqueuedResponse

object

Returned by `POST /api/github/imports` once the target repo is created and the import job is enqueued. The SPA navigates to `/{owner}/{repo}` and watches the existing import-progress SSE.

job_idrequired: string
Import job id (for debugging / correlation).
ownerrequired: string
reporequired: string

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when a classic OAuth token is asked for something its granted scopes do not cover — an explicit private listing without `repo`, or the one-click GitHub mirror without `admin:public_key`. `scope` names the missing grant so the client can say exactly what the token lacks. There is no elevation route to widen it any more (a re-link goes through the GitHub App, whose tokens carry no scopes), so the client's answer is to say so, never to start a handshake.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
404Not Found — one of: not_found
409Conflict — one of: already_exists, conflict
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget