repo.box platform docs

Deploy and operate private apps at https://<name>.repo.box. Reading these docs needs no token; every API call below needs Authorization: Bearer ….

Publisher quickstart: deploy an app

With a publisher token (rbpub_…, issued by an operator), one HTTPS request deploys an app, and the same request with the same name updates it. No registry, Git host, SSH or Docker access on repo.box is needed: you upload the image archive itself.

docker build --platform linux/amd64 -t myapp .
docker save myapp | gzip > myapp.tar.gz
curl -fsS -H "Authorization: Bearer $REPOBOX_PUBLISHER_TOKEN" \
  -F 'manifest={"name":"myapp","title":"My app","runtime":{"port":8080,"health_path":"/healthz"}};type=application/json' \
  -F image=@myapp.tar.gz \
  'https://auth.repo.box/api/platform/v1/publisher/releases?wait=300'

Endpoint

POST https://auth.repo.box/api/platform/v1/publisher/releases[?wait=SECONDS]

Body

multipart/form-data with exactly two parts, in this order: manifest (JSON, type=application/json), then image (the archive)

Image

docker save output (tar or gzip tar), podman save --format docker-archive|oci-archive, or an OCI layout tar; exactly one linux/amd64 image, at most 2 GiB

Answer

202 while queued or in progress, 200 when done (?wait= long-polls up to 600 s). Read release.status (queued → building → starting → live | failed) and share app.launcher_url.

Limits

10 apps per publisher, 100 releases per 24 h

Minimal manifest

{"name": "myapp", "title": "My app"}

name (DNS label, becomes the host) and title are required. Optional: description, version, ai (default true), provenance (recorded only), and runtime: port (default: the image's single EXPOSE, else 8080; also $PORT), health_path (default /), memory_mb (64–1024, default 512), env. Unknown fields are refused; the full schema is ReleaseManifest in the OpenAPI document.

Release status, logs, rollback, restart

Every deploy answer also carries these as release.links and app.links. The same operations exist as MCP tools at POST https://auth.repo.box/api/platform/v1/mcp with the publisher bearer; image bytes travel only over the HTTPS upload.

What you get, and what v1 does not do

• Apps are private. Only people an operator grants (and admins) can open one, after signing in on auth.repo.box. The app has no login of its own: every request carries the edge-injected identity (X-RepoBox-User-Id, X-RepoBox-User, X-RepoBox-Role); key records on X-RepoBox-User-Id. A publisher cannot change visibility or grants.
• Persistent /data ($REPOBOX_DATA_DIR) survives updates, restarts and rollbacks; it is removed only if an operator removes the app. Everything outside /data comes from the running release's image.
• runtime.env is plain, non-secret configuration. Values are stored as sent with the release record and passed as ordinary container environment variables. Never put credentials there or bake them into the image.
• Not in v1: no secrets management, no database backup or export API (back up what is in /data from inside your app if you need it), no registry pulls or Git builds, no custom domains, no public visibility.
• Health gate: a release goes live only after GET health_path answers within 120 s; until then the previous release keeps serving.
• AI: the app's own pages may call POST /_repo_box/ai/v1/chat/completions same-origin (OpenAI chat.completions subset, non-streaming, no key). See the skill.

Tokens

• Publisher token rbpub_…: deploys and operates the apps that publisher created (https://auth.repo.box/api/platform/v1/publisher/*).
• Service token rbp_…: owner-scoped reads, AI policy and app registration requests (https://auth.repo.box/api/platform/v1/apps …). It cannot deploy.
• Both are issued by an operator, expire and can be revoked. Neither is OAuth or a browser session. A 401 means the header is missing, the wrong kind, expired or revoked.