Start making the author GitHub App from a manifest (owner or admin)
Returns the manifest for a new author App and the GitHub URL the browser form-POSTs it to (field manifest), with a new single-use state in that URL, valid 60 minutes and bound to the caller and the workspace. owner picks an organization (its owners can create the App) or the caller's own account; a private App (public: false, the default) installs only on that account. The manifest asks for contents and pull_requests write and metadata read, plus actions and workflows write with actions: true; its webhook is off, its redirect is the console's /settings/workspace/integrations/github/new-app and its callback the account-link page. The App it makes is always another author connection, beside any registered: replace is ignored, and moving to the new App is removing the old connection afterwards. API keys are refused.
Auth: cookie session only; no scope. Idempotency-Key: ignored.
cookieSession__Host-werft_session<token>For the web console: the browser session cookie set by POST /v1/auth/login. It holds the scopes of the user's workspace role (owner: all; admin and member: all but sessions:recover). Requests other than GET must also send X-Requested-With: werft-web.
id*stringThe workspace's id.
^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidX-Requested-With?"werft-web"Required with a cookie session: the literal werft-web.
"werft-web"application/json- body
owner*|public?booleanfalseactions?booleanfalsereplace?booleanfalseWhere the browser posts the manifest, and when the state expires.
application/json- response
action_url*stringurimanifest*string2 <= lengthexpires_at*string^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$date-timecurl -X POST 'https://example.com/v1/workspaces/497f6eca-6276-4993-bfeb-53cbbbba6f08/github-apps/author/manifest' \ -H 'Content-Type: application/json' \ -d '{ "owner": { "kind": "organization", "login": "acme" }, "public": false, "actions": false}'{ "action_url": "https://github.com/organizations/acme/settings/apps/new?state=<single-use>", "manifest": "{\"name\":\"werft-acme-1a2b\",\"public\":false}", "expires_at": "2026-11-01T10:00:00Z"}