Skip to content
bucker

API reference

proposals

5 operations. Shapes are sketches of the declared schemas, bounded in depth — the authoritative document is linked from the index.

GET/orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}

Requires bearerAuth

Parameters

Parameters for GET /orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}
NameInTypeNotes
orgSlugrequiredpathstringmin length 1
projectSlugrequiredpathstringmin length 1
idrequiredpathstringmin length 1

Response 200

{
  id: string
  runId: string
  issueId: string
  title: string
  summary: string
  diff: string
  filesChanged: string[]
  status: "DRAFT" | "AWAITING_APPROVAL" | "READY_UNPUSHED" | "PR_OPEN" | "APPROVED" | "REJECTED" | "MERGED" | "SUPERSEDED"
  verificationTier: "A" | "B" | "C" | "VOID" | "NONE"
  billable: boolean
  branch: string | null
  prUrl: string | null
  prNumber: number | null
  pushError: string | null
  approvalRequestId: string | null
  approvedByPrincipalId: string | null
  approvedAt: string | null
  rejectedByPrincipalId: string | null
  rejectedAt: string | null
  rejectionReason: string | null
  supersededAt: string | null
  supersededReason: string | null
  mergedAt: string | null
  watchUntil: string | null
  … 3 more
}

Response 400 · `bad_request` — the path, query or body failed validation. `details` carries the Zod issues, one per offending field.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 401 · `unauthorized` — no credential, or one that is expired, revoked or not valid for this resource. `mfa_required` when the credential is good but a second factor is owed.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 403 · `forbidden` — the credential is valid and its scopes or this principal’s membership do not reach this resource. Scopes are re-intersected with live memberships on every request, so this can appear for a token that worked yesterday.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 404 · `not_found` — no such resource, OR one this principal cannot see. The two are deliberately one answer: a 403 would confirm the existence of something whose identifier is guessable.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 429 · `rate_limited` or `quota_exceeded` — over a ceiling. `Retry-After` says when to come back, and `x-ratelimit-limit` / `-remaining` / `-reset` describe the bucket.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 500 · `internal_error` — an unhandled failure on this side. The message is always generic; `requestId` is the part worth quoting.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Request

curl https://api.bucker.io/orgs/{orgSlug}/projects/{projectSlug}/proposals/{id} \
  -H 'authorization: Bearer $BUCKER_TOKEN'

POST/orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/abandon

Requires bearerAuth

Parameters

Parameters for POST /orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/abandon
NameInTypeNotes
orgSlugrequiredpathstringmin length 1
projectSlugrequiredpathstringmin length 1
idrequiredpathstringmin length 1

Request body (required) · application/json

{
  reason: string
}

Response 200

{
  proposal: {
    id: string
    runId: string
    issueId: string
    title: string
    summary: string
    diff: string
    filesChanged: string[]
    status: "DRAFT" | "AWAITING_APPROVAL" | "READY_UNPUSHED" | "PR_OPEN" | "APPROVED" | "REJECTED" | "MERGED" | "SUPERSEDED"
    verificationTier: "A" | "B" | "C" | "VOID" | "NONE"
    billable: boolean
    branch: string | null
    prUrl: string | null
    prNumber: number | null
    pushError: string | null
    approvalRequestId: string | null
    approvedByPrincipalId: string | null
    approvedAt: string | null
    rejectedByPrincipalId: string | null
    rejectedAt: string | null
    rejectionReason: string | null
    supersededAt: string | null
    supersededReason: string | null
    mergedAt: string | null
    watchUntil: string | null
    … 3 more
  }
}

Response 400 · `bad_request` — the path, query or body failed validation. `details` carries the Zod issues, one per offending field.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 401 · `unauthorized` — no credential, or one that is expired, revoked or not valid for this resource. `mfa_required` when the credential is good but a second factor is owed.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 403 · `forbidden` — the credential is valid and its scopes or this principal’s membership do not reach this resource. Scopes are re-intersected with live memberships on every request, so this can appear for a token that worked yesterday.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 404 · `not_found` — no such resource, OR one this principal cannot see. The two are deliberately one answer: a 403 would confirm the existence of something whose identifier is guessable.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 429 · `rate_limited` or `quota_exceeded` — over a ceiling. `Retry-After` says when to come back, and `x-ratelimit-limit` / `-remaining` / `-reset` describe the bucket.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 500 · `internal_error` — an unhandled failure on this side. The message is always generic; `requestId` is the part worth quoting.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Request

curl -X POST https://api.bucker.io/orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/abandon \
  -H 'authorization: Bearer $BUCKER_TOKEN' \
  -H 'content-type: application/json' \
  -d '{ … }'

POST/orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/approve

Requires bearerAuth

Parameters

Parameters for POST /orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/approve
NameInTypeNotes
orgSlugrequiredpathstringmin length 1
projectSlugrequiredpathstringmin length 1
idrequiredpathstringmin length 1

Request body (required) · application/json

{
  reason?: string
}

Response 200

{
  proposal: {
    id: string
    runId: string
    issueId: string
    title: string
    summary: string
    diff: string
    filesChanged: string[]
    status: "DRAFT" | "AWAITING_APPROVAL" | "READY_UNPUSHED" | "PR_OPEN" | "APPROVED" | "REJECTED" | "MERGED" | "SUPERSEDED"
    verificationTier: "A" | "B" | "C" | "VOID" | "NONE"
    billable: boolean
    branch: string | null
    prUrl: string | null
    prNumber: number | null
    pushError: string | null
    approvalRequestId: string | null
    approvedByPrincipalId: string | null
    approvedAt: string | null
    rejectedByPrincipalId: string | null
    rejectedAt: string | null
    rejectionReason: string | null
    supersededAt: string | null
    supersededReason: string | null
    mergedAt: string | null
    watchUntil: string | null
    … 3 more
  }
  approval: {
    status: string
    approvals: number
    remaining: number
  }
  pullRequest: {
    number: number
    url: string
    branch: string
    sha: string
  } | null
  pushError: string | null
  trustLadder: {
    category: string
    rung: "RCA_ONLY" | "DRAFT_PR" | "AUTO_ATTEMPT"
    nextRung: "RCA_ONLY" | "DRAFT_PR" | "AUTO_ATTEMPT" | null
    acceptanceRate: number
    sampleSize: number
    approvals: number
    rejections: number
    regressions: number
    consecutiveApprovals: number
    approvalsUntilOffer: number
    promotionOffered: boolean
    offeredRung: "RCA_ONLY" | "DRAFT_PR" | "AUTO_ATTEMPT" | null
    blockers: string[]
    autonomousProposalAllowed: boolean
    mergeAllowed: false
    summary: string
  } | null
}

Response 400 · `bad_request` — the path, query or body failed validation. `details` carries the Zod issues, one per offending field.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 401 · `unauthorized` — no credential, or one that is expired, revoked or not valid for this resource. `mfa_required` when the credential is good but a second factor is owed.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 403 · `forbidden` — the credential is valid and its scopes or this principal’s membership do not reach this resource. Scopes are re-intersected with live memberships on every request, so this can appear for a token that worked yesterday.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 404 · `not_found` — no such resource, OR one this principal cannot see. The two are deliberately one answer: a 403 would confirm the existence of something whose identifier is guessable.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 429 · `rate_limited` or `quota_exceeded` — over a ceiling. `Retry-After` says when to come back, and `x-ratelimit-limit` / `-remaining` / `-reset` describe the bucket.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 500 · `internal_error` — an unhandled failure on this side. The message is always generic; `requestId` is the part worth quoting.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Request

curl -X POST https://api.bucker.io/orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/approve \
  -H 'authorization: Bearer $BUCKER_TOKEN' \
  -H 'content-type: application/json' \
  -d '{ … }'

GET/orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/certificate

Requires bearerAuth

Parameters

Parameters for GET /orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/certificate
NameInTypeNotes
orgSlugrequiredpathstringmin length 1
projectSlugrequiredpathstringmin length 1
idrequiredpathstringmin length 1

Response 200

{
  certificate: {
    payload: unknown
    signature: string
    algorithm: string
    signedAt: string
  }
  verification: {
    valid: boolean
    failures: {
      code: string
      message: string
    }[]
  }
  summary: string
}

Response 400 · `bad_request` — the path, query or body failed validation. `details` carries the Zod issues, one per offending field.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 401 · `unauthorized` — no credential, or one that is expired, revoked or not valid for this resource. `mfa_required` when the credential is good but a second factor is owed.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 403 · `forbidden` — the credential is valid and its scopes or this principal’s membership do not reach this resource. Scopes are re-intersected with live memberships on every request, so this can appear for a token that worked yesterday.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 404 · `not_found` — no such resource, OR one this principal cannot see. The two are deliberately one answer: a 403 would confirm the existence of something whose identifier is guessable.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 429 · `rate_limited` or `quota_exceeded` — over a ceiling. `Retry-After` says when to come back, and `x-ratelimit-limit` / `-remaining` / `-reset` describe the bucket.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 500 · `internal_error` — an unhandled failure on this side. The message is always generic; `requestId` is the part worth quoting.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Request

curl https://api.bucker.io/orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/certificate \
  -H 'authorization: Bearer $BUCKER_TOKEN'

POST/orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/reject

Requires bearerAuth

Parameters

Parameters for POST /orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/reject
NameInTypeNotes
orgSlugrequiredpathstringmin length 1
projectSlugrequiredpathstringmin length 1
idrequiredpathstringmin length 1

Request body (required) · application/json

{
  reason: string
}

Response 200

{
  proposal: {
    id: string
    runId: string
    issueId: string
    title: string
    summary: string
    diff: string
    filesChanged: string[]
    status: "DRAFT" | "AWAITING_APPROVAL" | "READY_UNPUSHED" | "PR_OPEN" | "APPROVED" | "REJECTED" | "MERGED" | "SUPERSEDED"
    verificationTier: "A" | "B" | "C" | "VOID" | "NONE"
    billable: boolean
    branch: string | null
    prUrl: string | null
    prNumber: number | null
    pushError: string | null
    approvalRequestId: string | null
    approvedByPrincipalId: string | null
    approvedAt: string | null
    rejectedByPrincipalId: string | null
    rejectedAt: string | null
    rejectionReason: string | null
    supersededAt: string | null
    supersededReason: string | null
    mergedAt: string | null
    watchUntil: string | null
    … 3 more
  }
  constraints: string[]
  trustLadder: {
    category: string
    rung: "RCA_ONLY" | "DRAFT_PR" | "AUTO_ATTEMPT"
    nextRung: "RCA_ONLY" | "DRAFT_PR" | "AUTO_ATTEMPT" | null
    acceptanceRate: number
    sampleSize: number
    approvals: number
    rejections: number
    regressions: number
    consecutiveApprovals: number
    approvalsUntilOffer: number
    promotionOffered: boolean
    offeredRung: "RCA_ONLY" | "DRAFT_PR" | "AUTO_ATTEMPT" | null
    blockers: string[]
    autonomousProposalAllowed: boolean
    mergeAllowed: false
    summary: string
  } | null
}

Response 400 · `bad_request` — the path, query or body failed validation. `details` carries the Zod issues, one per offending field.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 401 · `unauthorized` — no credential, or one that is expired, revoked or not valid for this resource. `mfa_required` when the credential is good but a second factor is owed.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 403 · `forbidden` — the credential is valid and its scopes or this principal’s membership do not reach this resource. Scopes are re-intersected with live memberships on every request, so this can appear for a token that worked yesterday.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 404 · `not_found` — no such resource, OR one this principal cannot see. The two are deliberately one answer: a 403 would confirm the existence of something whose identifier is guessable.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 429 · `rate_limited` or `quota_exceeded` — over a ceiling. `Retry-After` says when to come back, and `x-ratelimit-limit` / `-remaining` / `-reset` describe the bucket.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Response 500 · `internal_error` — an unhandled failure on this side. The message is always generic; `requestId` is the part worth quoting.

{
  error: {
    code: "bad_request" | "conflict" | "forbidden" | "internal_error" | "mfa_required" | "not_found" | "payload_too_large" | "quota_exceeded" | … 6 more
    message: string
    details?: unknown
    requestId?: string
  }
}

Request

curl -X POST https://api.bucker.io/orgs/{orgSlug}/projects/{projectSlug}/proposals/{id}/reject \
  -H 'authorization: Bearer $BUCKER_TOKEN' \
  -H 'content-type: application/json' \
  -d '{ … }'