Search Composal documentation

Search public documentation, commands, and release notes.

API reference

Use Composal OpenAPI to build typed clients for Verify, hosting, and registry workflows. Learn authentication, authorization, and concurrency rules.

Contents

OpenAPI document

Use the generated OpenAPI document to build an SDK or typed client, or load it into an interactive API client.

Open the OpenAPI JSON

API areas

  • Authentication and current user session
  • Organizations, members, and invitations
  • Projects, Scenarios, Personas, Credentials, environments and revisions
  • Grouped Scenario Runs, PR relevance selection, discovery and run evidence
  • Findings, evidence, metrics, and organization memory
  • Hosting apps, environments, services, deployments, domains, CDN, and static sites
  • Image repositories, registry tokens, and tag listing

Authenticated web landing

GET /api/v1/me/landing returns a path for the signed-in user's active organization. It opens the only active project directly, or Verify home when there are zero or multiple active projects. Archived projects are excluded. The endpoint requires authentication and does not change the selected organization.

Authorization and concurrency

Verify endpoints require organization membership and Verify access. Actions that change configuration or runs require administrator access whenever the dashboard requires it. The Verify MCP connector uses OAuth scoped to one organization and the verification resource. Each endpoint also checks your permissions.

The API caches the user identity from a valid personal access token for up to 20 minutes to speed up repeated requests. Token revocation and changes to the cached user profile can take up to 20 minutes to reach every API worker. A cache entry expires no later than the token. The API checks organization membership and repository permissions separately from this identity cache.

Browser-session user identities use the same 20-minute cache window. Profile and account-access changes can take up to that long to become visible to an existing session. The browser session cookie must still be valid; signing out removes it from the browser.

When retrying a Verify request that changes state, reuse its idempotency key and the IDs and digests returned by planning. See the CLI reference for commands that use the same API contract.