Information
- OpenAPI version:
3.0.3
Overview
BuildTrace API (beta) 0.1.0
Section titled “BuildTrace API (beta) 0.1.0”This API is in beta: endpoints and fields may change before 1.0. This file lists the operations meant for integrations, authenticated with a service-account token. The web app uses further endpoints that are not part of the public contract.
Hardware MES API.
NOTE: attachment upload (POST /attachments, multipart/form-data) and
download (GET /attachments/{id}/download, streams the bytes; 410 if the stored file is gone)
are NOT declared here. They do not fit the strict-server model (multipart
body + redirect response), so they are implemented as plain chi routes wired
directly on the mux, each protected by an access-token check. Only the
attachment list + delete operations are strict ops below.
Similarly, three field/OTA routes are NOT declared here and are plain chi
routes wired on the mux: POST /firmware-versions/{id}/release
(multipart/form-data firmware binary upload, access-token), GET /serials/{id}/sbom (writes a CycloneDX JSON document, access-token), and
POST /device/checkin (device-token authenticated: Bearer <device-token>,
not a JWT). All other field/OTA operations below are strict ops.
Device check-in (POST /device/checkin) and SBOM download (GET /serials/{id}/sbom) are not in this spec; see Device check-in and SBOM export.
Authentication
Section titled “Authentication”bearerAuth
Section titled “bearerAuth”Access token from POST /auth/token. Create a service account in Settings (a workspace admin can), then exchange its clientId and clientSecret with grantType set to client_credentials. Send the token as Authorization: Bearer <token>.
Security scheme type: http
Bearer format: JWT