# Code Storage HTTP API > Section index for the Code Storage (code.storage) developer platform: the HTTP > API, its OpenAPI description, authentication, webhooks, the SDKs and the MCP > server. The site-wide index is https://code.storage/llms.txt. ## When to use the Code Storage API The Code Storage HTTP API mirrors the SDK's primitives over plain HTTPS, so any runtime can drive repositories without a local git client. Use it to create a repository, mint a Git remote URL, list and page through branches and commits, read and stream files, grep and blame, create a commit from files or from a diff, preview and perform a merge, and manage tags and notes. Use the Git protocol instead when you already have a working copy and want clone, push or fetch; use the SDK when you are writing TypeScript, Python or Go and would rather not hand-roll JWT minting. ## Calling the Code Storage API - Base URL: https://api.{org}.code.storage/api — {org} is your organization identifier. - Authentication: Authorization: Bearer , on every request. The token is signed by you with your own ES256 or RS256 private key. It names a single repository in its repo claim (org-wide org:read tokens excepted), carries explicit scopes, and expires at its exp claim. - Scopes: git:read (clone, fetch, pull), git:write (push; includes read), repo:write (create repositories), org:read (list repositories across the organization). - Paths: preferred routes use the short /api/... form. The older /api/v1/... aliases remain documented and are marked deprecated where a preferred route has replaced them. - Repository names containing / must be URL encoded into one path segment: pierre/example becomes /api/repos/pierre%2Fexample. The server decodes once, so do not double-encode. - Pagination: list endpoints are cursor based. Send cursor and limit (default 20, capped per endpoint); responses carry next_cursor and has_more. - Errors: RFC 9457 problem details under application/problem+json, with a legacy error field mirroring detail. - Rate limits: a 429 response carries the current IETF RateLimit service-limit field and Retry-After. RateLimit reports zero immediately available requests and an effective window; Retry-After is the minimum delay and takes precedence. Capacity is dynamic, so successful responses do not advertise a fixed RateLimit-Policy. A first call: curl "https://api.your-org.code.storage/api/repos" \ -H "Authorization: Bearer $CODE_STORAGE_TOKEN" \ -H "Content-Type: application/json" ## Code Storage API resources - [Code Storage HTTP API reference](https://code.storage/docs/reference/api/overview): Base config, pagination, and error handling, with a generated page per endpoint under /docs/reference/api/. - [Code Storage OpenAPI spec](https://code.storage/openapi.json): OpenAPI 3.1 description of every endpoint, served unauthenticated. - [Code Storage API catalog](https://code.storage/.well-known/api-catalog): RFC 9727 catalog linking the API to its OpenAPI description (JSON and YAML) and its reference docs. - [Code Storage Authentication & Security](https://code.storage/docs/getting-started/authentication): Token structure, supported algorithms, permission scopes, TTLs, and manual JWT creation. - [Code Storage SDK reference](https://code.storage/docs/reference/sdk/index): The same primitives from TypeScript, Python and Go. - [Code Storage webhooks](https://code.storage/docs/guides/webhooks): push and repo.sync.* events delivered as HTTP POSTs, with HMAC-SHA256 signature verification and SDK helpers. - [Code Storage Git protocol guide](https://code.storage/docs/guides/git-operations): clone, push, pull and fetch over JWT-authenticated HTTPS remotes. - [Code Storage MCP server](https://code.storage/docs/mcp): Streamable HTTP MCP endpoint whose tools search the Code Storage docs; setup at https://code.storage/docs/getting-started/agent-setup. ## Related guides - [Git LFS](https://code.storage/docs/guides/git-lfs): Large files over the same authenticated remote, with no separate LFS server. - [Git Notes](https://code.storage/docs/guides/git-notes): Attach metadata to commits and keep commit history unchanged. - [Ref Policies](https://code.storage/docs/guides/ref-policies): Use JWT ref policies for branch protection. Limit the refs that a token can update and the update types it permits. - [Commit Signing](https://code.storage/docs/guides/commit-signing): Require valid OpenPGP or SSH commit signatures on selected refs. - [Import Namespace](https://code.storage/docs/guides/imports): Import large repositories with immediate cold archival. - [Ephemeral Namespace](https://code.storage/docs/guides/ephemeral-branches): Use isolated branches for previews, CI artifacts, and experiments. - [Repository Forks](https://code.storage/docs/guides/forking): Create lightweight copies of existing repositories. - [GitHub Sync](https://code.storage/docs/guides/github-sync): Mirror a GitHub repository with GitHub App sync or public mode. - [Generic Sync](https://code.storage/docs/guides/generic-sync): Mirror a GitLab, Bitbucket, Gitea, Forgejo, Codeberg, or SourceHut repository over HTTPS. - [Connect a Sandbox](https://code.storage/docs/guides/sandboxes): Clone repositories into third-party sandbox providers with authenticated Git URLs. - [Store Session State](https://code.storage/docs/guides/session-state): Store session state as ephemeral commits and keep normal branches unchanged. - [Resume Sandbox Work](https://code.storage/docs/guides/resume-sandbox-work): Restore the last session state in a new sandbox. - [Run Parallel Attempts](https://code.storage/docs/guides/parallel-attempts): Start several attempts from one commit and compare their diffs. - [Show Live Diffs](https://code.storage/docs/guides/live-diffs): Render an agent branch as a live diff and refresh it after each new state. ## Other indexes - [Site index (llms.txt)](https://code.storage/llms.txt): Everything Code Storage publishes, including when-to-use guidance. - [Docs index (llms.txt)](https://code.storage/docs/llms.txt): The documentation section, regenerated when the docs change. - [Full text (llms-full.txt)](https://code.storage/llms-full.txt): The site surface expanded into prose.