Skip to content
ChekChek Docs

Add a repository

POST
/api/v1/extension-repositories
curl --request POST \
  --url http://localhost:8080/api/v1/extension-repositories \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "url": "chek.page/extensions", "credentials": { "type": "bearer", "token": "example" } }'

An admin adds to the allow list. Other users add a repository of their own, which needs allowAnyRepository. The server fetches the index first and refuses a repository whose index it can’t read.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
url
required

Where the repository is, stored as its index’s URL:

  • the index itself, such as https://example.org/chek/index.json;
  • the folder holding index.json, such as https://chek.page/extensions or chek.page/extensions;
  • a GitHub repository as github:owner/repo, optionally with @ref for a branch or tag and /path for a folder, read from its raw files.
string

Example 

chek.page/extensions
credentials
One of:
object
type
required
Allowed value: bearer
token
required
string

Responses

Section titled “Responses”

201

Section titled “201”

The added repository.

Media typeapplication/json
object
id
required
integer format: int64
url
required
string format: uri
name
required

What the repository’s index calls it.

string | null
allowListed
required

On the admin’s allow list rather than added by the user.

boolean
usable
required

Whether its extensions can be installed and run. A user’s own repository isn’t while the admin allows only the allow list.

boolean
hasCredentials
required

Whether credentials are stored for it. They’re never returned.

boolean
extensionCount
required
integer
fetchedAt
required

When the index was last fetched successfully.

string | null format: date-time
fetchError
required

Why the last fetch failed, if it did.

string | null
createdAt
required
string format: date-time

Example generated

{
  "id": 1,
  "url": "https://example.com",
  "name": "example",
  "allowListed": true,
  "usable": true,
  "hasCredentials": true,
  "extensionCount": 1,
  "fetchedAt": "2026-04-15T12:00:00Z",
  "fetchError": "example",
  "createdAt": "2026-04-15T12:00:00Z"
}

400

Section titled “400”

The request was malformed.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

401

Section titled “401”

The request has no valid session token.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

403

Section titled “403”

Only an admin can add repositories while just the allow list is allowed.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

409

Section titled “409”

The repository has already been added to this list.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

422

Section titled “422”

The repository answered 401 or 403, or is a host known to refuse another way: a private GitHub repository’s 404, or Cloudflare Access’s redirect to its sign-in page. The code says what to ask for, from the scheme of its WWW-Authenticate header: repository_needs_token (Bearer), repository_needs_password (Basic), or repository_needs_credentials (another scheme or none, as for a host that checks its own headers). repository_credentials_refused means credentials were sent and refused. Not 401, which would mean the client’s own session ended.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

500

Section titled “500”

The server failed; details are in its log.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}

502

Section titled “502”

The repository’s index couldn’t be fetched or isn’t valid.

Media typeapplication/json
object
code
required
string
Allowed values: bad_request unauthorized forbidden not_found unavailable scan_in_progress content_changed already_set_up name_taken last_admin progress_conflict too_many_attempts not_linked identity_taken last_sign_in provider_unavailable too_many_sign_ins repository_exists repository_not_allowed repository_unreadable repository_needs_token repository_needs_password repository_needs_credentials repository_credentials_refused extension_invalid source_failed source_unavailable source_check_failed internal
message
required

Explains the problem to a developer.

string

Example 

{
  "code": "bad_request"
}