API

Arbinel keeps Forgejo’s API unchanged and adds the endpoints below. Forgejo’s API usage page covers authentication, tokens and pagination, which work the same in Arbinel. For request and response schemas, open /api/swagger on your instance, which lists Forgejo’s and Arbinel’s endpoints together.

Paths are relative to /api/v1. Auth names the token scope and the permission a user needs. Some endpoints authenticate an external system with its own token instead of a user.

CI quota

These endpoints need [quota] ENABLED and [quota.ci] ENABLED. See CI quota.

Method	Path	Auth	Purpose
GET	/user/quota/ci	user scope	CI time used and the limits that apply, for the signed-in user.
GET	/user/quota/ci/records	user scope	The CI runs that count towards the signed-in user’s usage.
GET	/orgs/{org}/quota/ci	organization scope, organization owner	CI time used and the limits that apply, for an organization.
GET	/orgs/{org}/quota/ci/records	organization scope, organization owner	The CI runs that count towards an organization’s usage.

For external CI systems

These endpoints exist only while [quota.ci] ENABLED is true. An external CI system calls them with its own token, sent as Authorization: Bearer <token>, whose SHA-256 is the TOKEN_HASH of a [quota.ci.reporter.<name>] section. A user token does not work here.

Method	Path	Auth	Purpose
GET	/quota/ci/check	reporter token	Ask whether the system may start work for a repository. The answer reserves nothing.
POST	/quota/ci/usage	reporter token	Report CI time spent. Reporting the same external_ref again charges once.

Egress quota

Site administrators use these endpoints for the system that counts download traffic and for the proxy that enforces the limit. See Egress quota.

Method	Path	Auth	Purpose
POST	/admin/egress/usage	admin scope, site administrator	Report the bytes each owner downloaded in a period, as one batch.
GET	/admin/egress/over-quota	admin scope, site administrator	List the owners over their egress limit in the current period. Empty while [quota] ENABLED is false.

Quota grants

These endpoints exist only while [quota.grants] ENABLED is true and at least one [integration.<name>] section is configured. An integration calls them with its own token, sent as Authorization: Bearer <token>, whose SHA-256 is the section’s TOKEN_HASH. The integration needs the quota.grants scope, and only sees and changes its own grants. See Quota grants.

Method	Path	Auth	Purpose
GET	/integrations/quota/grants	integration token	List the grants this integration keeps, optionally for one owner_id.
PUT	/integrations/quota/grants/{owner_id}	integration token	Replace all grants this integration keeps for a user or organization. An empty list removes them.

Pages

The repository endpoints answer 503 while Pages is turned off for the instance. See Pages and Publish a site with Pages.

Method	Path	Auth	Purpose
GET	/repos/{owner}/{repo}/pages	repository scope, repository administrator	Get the repository’s Pages configuration.
PUT	/repos/{owner}/{repo}/pages	repository scope, repository administrator	Turn Pages on, or change the branch it publishes.
DELETE	/repos/{owner}/{repo}/pages	repository scope, repository administrator	Turn Pages off and remove the site and its deploy key.
GET	/repos/{owner}/{repo}/pages/status	repository scope, repository administrator	Get the build and deploy key status.
GET	/repos/{owner}/{repo}/pages/log	repository scope, repository administrator	Get the latest build log.
PUT	/repos/{owner}/{repo}/pages/domains	repository scope, repository administrator	Replace the custom domains. The managed hostname stays, and exactly one domain is primary.
PUT	/repos/{owner}/{repo}/pages/branches/{branch}	repository scope, repository administrator	Publish another branch, at <owner>.<domain>/<repo>@<branch>/.
DELETE	/repos/{owner}/{repo}/pages/branches/{branch}	repository scope, repository administrator	Stop publishing an extra branch.
GET	/admin/pages/site-map	admin scope, site administrator	Map each site’s public hostname to where the Pages backend stores it, for the proxy that serves Pages.

Organization branch protection

These endpoints manage rules that an organization sets for all its repositories. See Branch protection.

Method	Path	Auth	Purpose
GET	/orgs/{org}/branch_protections	organization scope, organization owner	List the organization’s rules.
POST	/orgs/{org}/branch_protections	organization scope, organization owner	Create a rule.
GET	/orgs/{org}/branch_protections/{name}	organization scope, organization owner	Get a rule.
PATCH	/orgs/{org}/branch_protections/{name}	organization scope, organization owner	Change the fields you send.
DELETE	/orgs/{org}/branch_protections/{name}	organization scope, organization owner	Delete a rule.

Endpoints outside the API

Method	Path	Auth	Purpose
POST	/-/billing/creem/webhook	Creem’s signature, checked with [billing.creem] WEBHOOK_SECRET	Receive Creem’s subscription events. Exists only while [billing] ENABLED is true. See Billing.

The OAuth2 authorization endpoint also accepts prompt=select_account, which asks the user to choose one of their linked accounts.

Changes to Forgejo’s endpoints

Arbinel adds fields to some of Forgejo’s request and response bodies, and never removes or renames one:

• Branch protection rules have enable_force_push_allowlist, force_push_allowlist_usernames and force_push_allowlist_teams.
• A repository subscription (WatchInfo) reports watch_events and excluded_user_ids.
• Quota usage (QuotaUsed) reports egress.
• Quota rules accept the subjects time:ci:all, time:ci:actions, time:ci:external, time:ci:class:linux, time:ci:class:windows, time:ci:class:macos and egress:all.

With request budgets turned on, archive downloads, compare and diff endpoints, issue and pull request lists with filters, and /repos/issues/search can answer 429 Too Many Requests. The response carries Retry-After, RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers.