List repositories shared with the current user

GET/api/user/repos/shared

listSharedRepos

Repositories outside the caller's personal workspace that a grant — to the caller's account or to one of their teams — lets them read, most recently updated first, each with the caller's strongest role and the grant it comes from. A repository reached only as a workspace admin or member is not listed. `limit` defaults to 10 and is capped at 50; the list is not paginated, and `has_more` says whether it may continue.

Requires authentication using a bearer token or a session cookie — see tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/user/repos/shared' \
  -H 'Authorization: Bearer $NEOSOURCE_TOKEN'

fetch

fetch("https://neosource.dev/api/user/repos/shared", {
  method: "GET",
  headers: {
    Authorization: "Bearer $NEOSOURCE_TOKEN",
  },
});

Query parameters

limit: How many repositories to list; default 10, max 50.
integerint64
default10

Responses

200Shared repositories

application/json

SharedReposResponse

object

`GET /api/user/repos/shared` — repositories outside the caller's personal workspace that a grant gives them, most recently updated first.

has_morerequired

boolean

More shared repositories exist past this list. There is no cursor: the list is a dashboard section, not a page.

reposrequired

array

items

SharedRepoResponse

object

One shared repository with the caller's effective role on it and the grant that role comes from.

reporequired: RepoResponse
rolerequired: RepoRole
sourcerequired: RepoAccessSource

403Forbidden — one of: forbidden, needs_scope

application/json

one of

ErrorForbidden
NeedsScopeError
object
`403` body returned when a classic OAuth token is asked for something its granted scopes do not cover — an explicit private listing without `repo`, or the one-click GitHub mirror without `admin:public_key`. `scope` names the missing grant so the client can say exactly what the token lacks. There is no elevation route to widen it any more (a re-link goes through the GitHub App, whose tokens carry no scopes), so the client's answer is to say so, never to start a handshake.
errorrequired
string
Always `needs_scope` — this body exists to carry the extra fields that kind needs.
"needs_scope"
scoperequired
string
The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bad Request — one of: invalid_input
401Authentication required
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget

Schemas

Referenced above. Listed here rather than expanded inline, so the same definition is not repeated at every level.

`RepoResponse`

object

activity_at

integer | nullint64

When the repo last changed, as the owner list sorts and shows it (ms since the epoch): the later of `updated_at` (a settings write) and its last push. Present only on `GET /api/owners/{handle}/repos` rows, whose statement reads it; absent (not `null`) everywhere else. Set only through [`RepoResponse::with_activity_at`].

allowed_merge_methodsrequired

array

Which merge methods this repo permits at all. Never empty, and always in a canonical order (`merge` before `squash`) — it is a set, so the server normalises the order on write rather than echoing the order it was sent.

items

MergeMethod

string

How a pull request's commits land on its target branch. A repo carries two settings over this enum (`migrations/20260820120000_repo_merge_methods.sql`): the set it *permits* (`RepoRecord::allowed_merge_methods`, never empty) and the one the merge path reaches for when the request names none (`RepoRecord::default_merge_method`, always a member of that set — enforced by the settings route, which is the only place both columns are visible at once). `Default` is [`MergeMethod::Merge`] to match the column default, which is itself the pre-existing behaviour of every repo: before this setting existed, a merge always minted a two-parent commit. `Rebase` is deliberately absent rather than merely unimplemented — it replays N commits, can conflict per commit, and rewrites the SHAs the stacked-PR re-parent invariant leans on (`plans/archive/pr-merge-methods-2026-08.md` §"Not doing"). Adding it later is one `ALTER TYPE merge_method ADD VALUE` plus an arm here, which is why the stored shape is an enum array and not a pair of booleans.

"merge""squash"

created_atrequired

integerint64

created_byrequired

string

default_branchrequired

string

default_merge_methodrequired

MergeMethod

string

"merge""squash"

delete_branch_on_mergerequired

boolean

Whether merging a PR against this repo also deletes its source branch. `true` on a repo nobody has configured — see the settings route for why this one defaults on where the merge-method fields default to today's behaviour.

descriptionrequired

string

mirror_source_url

string | null

mirror_status

one of

RepoMirrorStatus
object
[`RepoResponse::mirror_status`]: how current a `_mirror` repository is.
last_synced_at
integer | nullint64
When the daily refresh last synced from the upstream (ms since the epoch); absent before the first sync.
latest_ci
one of
CommitStatusState
string
State of a single commit status, GitHub-shaped. `Error` is distinct from `Failure` on individual statuses (infrastructure/tooling breakage vs. a real red result) but the combined rollup folds both into `Failure`.
"pending""success""failure""error"
null
null

ownerrequired

string

parent

one of

RepoParentInfo
object
Summary of a fork's parent repository.
repo_idrequired
string
null

primary_language

string | null

The default branch's primary language: the language with the most code lines in the stored breakdown (ADR 0105, ADR 0187). Absent until a fill under the current classification policy has run, and for a repo with no code. An open vocabulary (tokei's names), like `LanguageStat::name`.

repo_idrequired

string

slugrequired

string

star_count

integer | nullint64

All-time star count. Present on exactly four routes — `GET /api/user/stars`, `GET /api/users/{handle}/stars`, `GET /api/repos?sort=trending` and `GET /api/owners/{handle}/repos` — whose store reads carry the count in the same statement. Absent (not `null`) everywhere else, including the default `GET /api/repos`: the repo detail's `stats.star_count` is the per-repo source. Set only through [`RepoResponse::with_star_count`].

statusrequired

RepoStatusOutput

string

Repo lifecycle state surfaced by the API. Mirrors `RepoStatus`. See ADR 0012 §2.

"creating""ready""importing""import_failed"

updated_atrequired

integerint64

versionrequired

integerint32

visibilityrequired

RepoVisibilityInput

string

"public""internal""private"

workspace_idrequired

string

`RepoRole`

string

Repo-level role (read/write/maintain/admin). Ordered low → high so `if role >= RepoRole::Write` reads naturally.

"read""write""maintain""admin"

`RepoAccessSource`

Where a shared repository's role comes from, discriminated by `kind`.

one of

object
A grant naming the caller's account.
kindrequired
string
"direct"
object
A grant naming a team the caller is in.
kindrequired
string
"team"
team
one of
SharedTeamRef
object
The team a shared repository's grant names.
keyrequired
string
The team key (`ENG`).
namerequired
string
The team's display name.
ownerrequired
string
The team's workspace slug — the `{owner}` of `/{owner}/teams/{key}`.
null