Depot docs imports

Registers the import and export routes.

This page is generated from the Depot route table. Every operation carries the permission it needs and the anchor an agent can link to.

GET /api/v1/docs/exports

GETdocs:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List doc exports

Parameters

Name	In	Type	Required	Description
limit	query	string	No
offset	query	string	No

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold docs:manage.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no storage configured, so documentation cannot be imported or exported.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/docs/exports?limit=<limit>&offset=<offset>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/docs/exports?limit=<limit>&offset=<offset>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/docs/exports"
params = {
    "limit": "<limit>",
    "offset": "<offset>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/docs/exports?limit=<limit>&offset=<offset>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/docs/exports");
url.searchParams.set("limit", "<limit>");
url.searchParams.set("offset", "<offset>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/docs/exports?limit=<limit>&offset=<offset>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/docs/exports

POSTdocs:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

createDocExport queues an export.

THE PERMISSION IS DECIDED HERE. A caller who asks for secrets without vault:reveal is REFUSED rather than quietly given an export with nulls in it: an operator who believes they have a full backup and does not is worse off than one who was told no.

Request body

Required, sent as application/json.

Field	Type	Description
clientIdsrequired	array of string
includeAttachments	boolean or null
includeSecretsrequired	boolean

Responses

Status	Body	Description
202	application/json, ExportJobJSON	Accepted.
400	application/problem+json, ProblemDetails	The request body is not valid JSON.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	Including the passwords in an export needs the vault reveal permission. Ask again without them, or ask an administrator for the permission.
404	application/problem+json, ProblemDetails	No resource matches.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	The request failed.
501	application/problem+json, ProblemDetails	This Depot cannot store import and export jobs yet.
503	application/problem+json, ProblemDetails	This Depot has no storage configured, so documentation cannot be imported or exported.

202 response body

Field	Type	Description
clientIds	array of string
completedAt	string
createdAtrequired	string
createdBy	string
downloadablerequired	boolean
error	string
expiresAt	string
idrequired	string
includeAttachmentsrequired	boolean
includeSecretsrequired	boolean
manifest	Manifest	Manifest is the receipt, and it NEVER carries a value out of the data.
manifest.clientsrequired	array of ClientManifest
manifest.clients[].countsrequired	object
manifest.clients[].namerequired	string
manifest.clients[].publicIdrequired	string
manifest.countsrequired	object
manifest.generatedAtrequired	string (date-time)
manifest.includeAttachmentsrequired	boolean
manifest.includeSecretsrequired	boolean
manifest.jobPublicIdrequired	string
manifest.omissionsrequired	array of Omission
manifest.omissions[].countrequired	integer
manifest.omissions[].whatrequired	string
manifest.omissions[].whyrequired	string
manifest.productrequired	string
manifest.schemaVersionrequired	integer
manifest.secretsIncludedrequired	integer
manifest.secretsOmittedrequired	integer
manifest.unavailableClientsrequired	array of string
quarantined	boolean
sizeBytesrequired	integer	int64.
staterequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/docs/exports' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "clientIds": [
    "string"
  ],
  "includeAttachments": false,
  "includeSecrets": false
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "clientIds": [
    "string"
  ],
  "includeAttachments": false,
  "includeSecrets": false
}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/docs/exports' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/docs/exports"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "clientIds": [
        "string",
    ],
    "includeAttachments": False,
    "includeSecrets": False,
}

response = requests.post(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "clientIds": [
    "string"
  ],
  "includeAttachments": false,
  "includeSecrets": false
}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/docs/exports", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/docs/exports";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "clientIds": [
      "string"
    ],
    "includeAttachments": false,
    "includeSecrets": false
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "clientIds": [
    "string"
  ],
  "includeAttachments": false,
  "includeSecrets": false
}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/docs/exports");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/docs/exports/{jobId}

GETdocs:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Get doc export

Parameters

Name	In	Type	Required	Description
jobId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, ExportJobJSON	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold docs:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	The request failed.
501	application/problem+json, ProblemDetails	This Depot cannot store import and export jobs yet.
503	application/problem+json, ProblemDetails	This Depot has no storage configured, so documentation cannot be imported or exported.

200 response body

Field	Type	Description
clientIds	array of string
completedAt	string
createdAtrequired	string
createdBy	string
downloadablerequired	boolean
error	string
expiresAt	string
idrequired	string
includeAttachmentsrequired	boolean
includeSecretsrequired	boolean
manifest	Manifest	Manifest is the receipt, and it NEVER carries a value out of the data.
manifest.clientsrequired	array of ClientManifest
manifest.clients[].countsrequired	object
manifest.clients[].namerequired	string
manifest.clients[].publicIdrequired	string
manifest.countsrequired	object
manifest.generatedAtrequired	string (date-time)
manifest.includeAttachmentsrequired	boolean
manifest.includeSecretsrequired	boolean
manifest.jobPublicIdrequired	string
manifest.omissionsrequired	array of Omission
manifest.omissions[].countrequired	integer
manifest.omissions[].whatrequired	string
manifest.omissions[].whyrequired	string
manifest.productrequired	string
manifest.schemaVersionrequired	integer
manifest.secretsIncludedrequired	integer
manifest.secretsOmittedrequired	integer
manifest.unavailableClientsrequired	array of string
quarantined	boolean
sizeBytesrequired	integer	int64.
staterequired	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/docs/exports/<jobId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/docs/exports/<jobId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/docs/exports/<jobId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/docs/exports/<jobId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/docs/exports/<jobId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/docs/exports/<jobId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/docs/exports/{jobId}/download

GETdocs:manageshared facehosteditmspremoteIdempotentdownloadNot fully resolved

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

What this page does not know

• response

These are parts of the route the extractor could not read from the source. Everything else on this page came straight from it.

Source: [object Object]

downloadDocExport streams the zip.

A SECOND STEP-UP, not just the one that queued it. The queue may have taken an hour and the download is where the bytes actually leave, so the freshness window is asked about again at the moment it matters.

Parameters

Name	In	Type	Required	Description
jobId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/octet-stream, string (binary)	Success. The body shape was not resolved; see x-outpost-unresolved.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	This export was made with the passwords in it, so downloading it needs the vault reveal permission. Ask an administrator for the permission, or make an export without them.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
410	application/problem+json, ProblemDetails	This export has expired and its file has been deleted. Make a new one.
500	application/problem+json, ProblemDetails	The request failed.
501	application/problem+json, ProblemDetails	This Depot cannot store import and export jobs yet.
502	application/problem+json, ProblemDetails	The export file could not be read out of storage.
503	application/problem+json, ProblemDetails	This Depot has no storage configured, so documentation cannot be imported or exported.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/docs/exports/<jobId>/download' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/docs/exports/<jobId>/download' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/docs/exports/<jobId>/download"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/docs/exports/<jobId>/download", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/docs/exports/<jobId>/download";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/docs/exports/<jobId>/download");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/docs/imports

GETdocs:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List doc imports

Parameters

Name	In	Type	Required	Description
limit	query	string	No
offset	query	string	No

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold docs:manage.
500	application/problem+json, ProblemDetails	The request failed.
503	application/problem+json, ProblemDetails	This Depot has no storage configured, so documentation cannot be imported or exported.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/docs/imports?limit=<limit>&offset=<offset>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/docs/imports?limit=<limit>&offset=<offset>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/docs/imports"
params = {
    "limit": "<limit>",
    "offset": "<offset>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/docs/imports?limit=<limit>&offset=<offset>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/docs/imports");
url.searchParams.set("limit", "<limit>");
url.searchParams.set("offset", "<offset>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/docs/imports?limit=<limit>&offset=<offset>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/docs/imports

POSTdocs:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

createDocImport takes the uploaded file and queues the dry run.

The file rides in the BODY and its metadata in the query string, which is the shape ticket attachments already use: a multipart parse would buy nothing over a raw stream and would spool a quarter of a gigabyte through memory to get it.

Parameters

Name	In	Type	Required	Description
clientId	query	string	No
fileName	query	string	No
matchSourceSystem	query	string	No
source	query	string	No

Request body

Required, sent as multipart/form-data.

The body is object.

Responses

Status	Body	Description
202	application/json, ImportJobJSON	Accepted.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold docs:manage.
404	application/problem+json, ProblemDetails	No resource matches.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
413	application/problem+json, ProblemDetails	The request was refused.
500	application/problem+json, ProblemDetails	The request failed.
501	application/problem+json, ProblemDetails	This Depot cannot store import and export jobs yet.
502	application/problem+json, ProblemDetails	The file could not be stored, so nothing was imported.
503	application/problem+json, ProblemDetails	This Depot has no storage configured, so documentation cannot be imported or exported.

202 response body

Field	Type	Description
completedAt	string
createdAtrequired	string
createdBy	string
error	string
fileNamerequired	string
idrequired	string
quarantined	boolean
report	Report	Report is one report the portal offers.
report.coderequired	string
report.formatsrequired	array of string
report.titlerequired	string
result	CommitResult	CommitResult is what the job row keeps and the console shows afterwards.
result.createdrequired	object
result.findingsrequired	array of Finding
result.findings[].Coderequired	string
result.findings[].Countrequired	integer
result.findings[].Detailrequired	string
result.findings[].Detailsrequired	array of string
result.flattenedrequired	integer
result.imagesNotImportedrequired	integer
result.orphanedCredentialsrequired	integer
result.rowsProcessedrequired	integer
result.rowsTotalrequired	integer
result.secretsFilledrequired	integer
result.skippedrequired	object
result.unresolvedLinksrequired	integer
result.updatedrequired	object
rowsProcessedrequired	integer
rowsTotalrequired	integer
sizeBytesrequired	integer	int64.
sourcerequired	string
startedAt	string
staterequired	string
targetClientId	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/docs/imports?clientId=<clientId>&fileName=<fileName>&matchSourceSystem=<matchSourceSystem>&source=<source>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: multipart/form-data' \
  -b 'outpost_console=<console-session>' \
  --data '{}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'multipart/form-data'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{}
'@

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/docs/imports?clientId=<clientId>&fileName=<fileName>&matchSourceSystem=<matchSourceSystem>&source=<source>' `
    -Headers $headers `
    -ContentType 'multipart/form-data' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/docs/imports"
params = {
    "clientId": "<clientId>",
    "fileName": "<fileName>",
    "matchSourceSystem": "<matchSourceSystem>",
    "source": "<source>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "multipart/form-data",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {}

response = requests.post(url, params=params, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{}`)

  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/docs/imports?clientId=<clientId>&fileName=<fileName>&matchSourceSystem=<matchSourceSystem>&source=<source>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "multipart/form-data")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/docs/imports");
url.searchParams.set("clientId", "<clientId>");
url.searchParams.set("fileName", "<fileName>");
url.searchParams.set("matchSourceSystem", "<matchSourceSystem>");
url.searchParams.set("source", "<source>");

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "multipart/form-data",
  },
  credentials: "include",
  body: JSON.stringify({}),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{}
""";

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/docs/imports?clientId=<clientId>&fileName=<fileName>&matchSourceSystem=<matchSourceSystem>&source=<source>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "multipart/form-data");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/docs/imports/{jobId}

GETdocs:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

Get doc import

Parameters

Name	In	Type	Required	Description
jobId	path	string	Yes	A uuid.

Responses

Status	Body	Description
200	application/json, ImportJobJSON	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold docs:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	The request failed.
501	application/problem+json, ProblemDetails	This Depot cannot store import and export jobs yet.
503	application/problem+json, ProblemDetails	This Depot has no storage configured, so documentation cannot be imported or exported.

200 response body

Field	Type	Description
completedAt	string
createdAtrequired	string
createdBy	string
error	string
fileNamerequired	string
idrequired	string
quarantined	boolean
report	Report	Report is one report the portal offers.
report.coderequired	string
report.formatsrequired	array of string
report.titlerequired	string
result	CommitResult	CommitResult is what the job row keeps and the console shows afterwards.
result.createdrequired	object
result.findingsrequired	array of Finding
result.findings[].Coderequired	string
result.findings[].Countrequired	integer
result.findings[].Detailrequired	string
result.findings[].Detailsrequired	array of string
result.flattenedrequired	integer
result.imagesNotImportedrequired	integer
result.orphanedCredentialsrequired	integer
result.rowsProcessedrequired	integer
result.rowsTotalrequired	integer
result.secretsFilledrequired	integer
result.skippedrequired	object
result.unresolvedLinksrequired	integer
result.updatedrequired	object
rowsProcessedrequired	integer
rowsTotalrequired	integer
sizeBytesrequired	integer	int64.
sourcerequired	string
startedAt	string
staterequired	string
targetClientId	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/docs/imports/<jobId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/docs/imports/<jobId>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/docs/imports/<jobId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/docs/imports/<jobId>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/docs/imports/<jobId>";

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/docs/imports/<jobId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST /api/v1/docs/imports/{jobId}/commit

POSTdocs:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

commitDocImport moves the job into the commit queue.

IT REFUSES WHILE THE DRY RUN IS BLOCKING, here as well as in the worker. The worker’s refusal is the one that matters, because it re-analyzes against the database as it is at commit time; this one exists so the operator is told in the response to the button they pressed rather than by a job that fails a minute later.

Parameters

Name	In	Type	Required	Description
jobId	path	string	Yes	A uuid.

Responses

Status	Body	Description
202	application/json, ImportJobJSON	Accepted.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold docs:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	This import was queued before Outpost recorded which client an import belongs to, so it is held until somebody says whose it is. See 0065_control.sql.
500	application/problem+json, ProblemDetails	The request failed.
501	application/problem+json, ProblemDetails	This Depot cannot store import and export jobs yet.
503	application/problem+json, ProblemDetails	This Depot has no storage configured, so documentation cannot be imported or exported.

202 response body

Field	Type	Description
completedAt	string
createdAtrequired	string
createdBy	string
error	string
fileNamerequired	string
idrequired	string
quarantined	boolean
report	Report	Report is one report the portal offers.
report.coderequired	string
report.formatsrequired	array of string
report.titlerequired	string
result	CommitResult	CommitResult is what the job row keeps and the console shows afterwards.
result.createdrequired	object
result.findingsrequired	array of Finding
result.findings[].Coderequired	string
result.findings[].Countrequired	integer
result.findings[].Detailrequired	string
result.findings[].Detailsrequired	array of string
result.flattenedrequired	integer
result.imagesNotImportedrequired	integer
result.orphanedCredentialsrequired	integer
result.rowsProcessedrequired	integer
result.rowsTotalrequired	integer
result.secretsFilledrequired	integer
result.skippedrequired	object
result.unresolvedLinksrequired	integer
result.updatedrequired	object
rowsProcessedrequired	integer
rowsTotalrequired	integer
sizeBytesrequired	integer	int64.
sourcerequired	string
startedAt	string
staterequired	string
targetClientId	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X POST 'https://depot.example.com/api/v1/docs/imports/<jobId>/commit' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Post `
    -Uri 'https://depot.example.com/api/v1/docs/imports/<jobId>/commit' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/docs/imports/<jobId>/commit"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.post(url, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodPost, "https://depot.example.com/api/v1/docs/imports/<jobId>/commit", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/docs/imports/<jobId>/commit";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://depot.example.com/api/v1/docs/imports/<jobId>/commit");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET /api/v1/docs/imports/{jobId}/matches

GETdocs:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

List doc import matches

Parameters

Name	In	Type	Required	Description
jobId	path	string	Yes	A uuid.
decision	query	string	No
limit	query	string	No
offset	query	string	No

Responses

Status	Body	Description
200	application/json, object	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold docs:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	The request conflicts with the current state.
500	application/problem+json, ProblemDetails	The request failed.
501	application/problem+json, ProblemDetails	This Depot cannot store import and export jobs yet.
503	application/problem+json, ProblemDetails	This Depot has no storage configured, so documentation cannot be imported or exported.

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X GET 'https://depot.example.com/api/v1/docs/imports/<jobId>/matches?decision=<decision>&limit=<limit>&offset=<offset>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -b 'outpost_console=<console-session>'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$response = Invoke-RestMethod `
    -Method Get `
    -Uri 'https://depot.example.com/api/v1/docs/imports/<jobId>/matches?decision=<decision>&limit=<limit>&offset=<offset>' `
    -Headers $headers

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/docs/imports/<jobId>/matches"
params = {
    "decision": "<decision>",
    "limit": "<limit>",
    "offset": "<offset>",
}
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}

response = requests.get(url, params=params, headers=headers, cookies=cookies, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  req, err := http.NewRequest(http.MethodGet, "https://depot.example.com/api/v1/docs/imports/<jobId>/matches?decision=<decision>&limit=<limit>&offset=<offset>", nil)
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = new URL("https://depot.example.com/api/v1/docs/imports/<jobId>/matches");
url.searchParams.set("decision", "<decision>");
url.searchParams.set("limit", "<limit>");
url.searchParams.set("offset", "<offset>");

const response = await fetch(url, {
  method: "GET",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
  },
  credentials: "include",
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Get, "https://depot.example.com/api/v1/docs/imports/<jobId>/matches?decision=<decision>&limit=<limit>&offset=<offset>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

PATCH /api/v1/docs/imports/{jobId}/matches/{matchId}

PATCHdocs:manageshared facehosteditmspremoteIdempotent

From an MSP console, prefix the path with /api/v1/clients/{clientID} to reach one client.

Source: [object Object]

patchDocImportMatch records one decision off the review table.

The two decisions this collects are the whole point of the dry run: skip this row, and put this ambiguous one in that client. A commit that ignored them would make the review page a lie.

THE MATCH IS NOT ASSUMED TO BE ON THE JOB IN THE PATH. This route used to read job A, check A’s state, and then write match B by its id alone - so a match belonging to a different job, on a different tenant, in a state where decisions are closed, could be redirected by naming it in the path beside a job the caller does own. The four facts travel together into one UPDATE whose predicate names all four (store.DocImportMatchDecision), and the 409 below survives only as the friendlier answer for the ordinary case: an operator clicking a row on a page that went stale while the commit started.

Parameters

Name	In	Type	Required	Description
jobId	path	string	Yes	A uuid.
matchId	path	string	Yes	A uuid.

Request body

Required, sent as application/json.

Field	Type	Description
decisionrequired	string
targetClientIdrequired	string
targetIdrequired	string

Responses

Status	Body	Description
200	application/json, ImportMatchJSON	Success.
400	application/problem+json, ProblemDetails	One or more validation errors occurred.
401	application/problem+json, ProblemDetails	No signed-in identity.
403	application/problem+json, ProblemDetails	The identity does not hold docs:manage.
404	application/problem+json, ProblemDetails	No resource matches that id.
409	application/problem+json, ProblemDetails	This import has already started committing, so its decisions can no longer be changed.
500	application/problem+json, ProblemDetails	The request failed.
501	application/problem+json, ProblemDetails	This Depot cannot store import and export jobs yet.
503	application/problem+json, ProblemDetails	This Depot has no storage configured, so documentation cannot be imported or exported.

200 response body

Field	Type	Description
decisionrequired	string
entityKindrequired	string
idrequired	string
note	string
sourceNamerequired	string
sourceRefrequired	string
targetClientId	string
targetId	string
targetName	string

Request samples

curl

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.
curl -X PATCH 'https://depot.example.com/api/v1/docs/imports/<jobId>/matches/<matchId>' \
  -H 'X-CSRF-Token: <csrf-token>' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'outpost_console=<console-session>' \
  --data '{
  "decision": "string",
  "targetClientId": "string",
  "targetId": "string"
}'

PowerShell

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

$headers = @{
    'X-CSRF-Token' = '<csrf-token>'
    'Accept' = 'application/json'
    'Content-Type' = 'application/json'
    'Cookie' = 'outpost_console=<console-session>'
}

$body = @'
{
  "decision": "string",
  "targetClientId": "string",
  "targetId": "string"
}
'@

$response = Invoke-RestMethod `
    -Method Patch `
    -Uri 'https://depot.example.com/api/v1/docs/imports/<jobId>/matches/<matchId>' `
    -Headers $headers `
    -ContentType 'application/json' `
    -Body $body

$response | ConvertTo-Json -Depth 10

Python

# Sign in first. outpost_console is a session cookie, so send it with every request.
# This operation is idempotent. Repeating it does not repeat its effect.

import requests

url = "https://depot.example.com/api/v1/docs/imports/<jobId>/matches/<matchId>"
headers = {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
}
cookies = {
    "outpost_console": "<console-session>",
}
payload = {
    "decision": "string",
    "targetClientId": "string",
    "targetId": "string",
}

response = requests.patch(url, headers=headers, cookies=cookies, json=payload, timeout=30)
response.raise_for_status()
print(response.json())

Go

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
package main

import (
  "bytes"
  "fmt"
  "io"
  "log"
  "net/http"
)

func main() {
  body := []byte(`{
  "decision": "string",
  "targetClientId": "string",
  "targetId": "string"
}`)

  req, err := http.NewRequest(http.MethodPatch, "https://depot.example.com/api/v1/docs/imports/<jobId>/matches/<matchId>", bytes.NewReader(body))
  if err != nil {
    log.Fatal(err)
  }

  req.Header.Set("X-CSRF-Token", "<csrf-token>")
  req.Header.Set("Accept", "application/json")
  req.Header.Set("Content-Type", "application/json")
  req.AddCookie(&http.Cookie{Name: "outpost_console", Value: "<console-session>"})

  resp, err := http.DefaultClient.Do(req)
  if err != nil {
    log.Fatal(err)
  }
  defer resp.Body.Close()

  out, err := io.ReadAll(resp.Body)
  if err != nil {
    log.Fatal(err)
  }
  fmt.Println(resp.Status, string(out))
}

TypeScript

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.
// The session cookie is set by signing in. A script cannot set it itself.

const url = "https://depot.example.com/api/v1/docs/imports/<jobId>/matches/<matchId>";

const response = await fetch(url, {
  method: "PATCH",
  headers: {
    "X-CSRF-Token": "<csrf-token>",
    "Accept": "application/json",
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({
    "decision": "string",
    "targetClientId": "string",
    "targetId": "string"
  }),
});

if (!response.ok) {
  throw new Error(`Request failed with status ${response.status}`);
}

const data = await response.json();
console.log(data);

C#

// Sign in first. outpost_console is a session cookie, so send it with every request.
// This operation is idempotent. Repeating it does not repeat its effect.

using System;
using System.Net.Http;
using System.Text;

using var client = new HttpClient();

const string body = """
{
  "decision": "string",
  "targetClientId": "string",
  "targetId": "string"
}
""";

var request = new HttpRequestMessage(HttpMethod.Patch, "https://depot.example.com/api/v1/docs/imports/<jobId>/matches/<matchId>");
request.Headers.TryAddWithoutValidation("X-CSRF-Token", "<csrf-token>");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Cookie", "outpost_console=<console-session>");
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());