API

Pro and Business. On Hobby every call is answered 403 with the code plan_required, and the Create token button is disabled. Your role also needs the tokens:manage permission, which every built-in role has. See Create an API token and pick scopes.

Only what its scopes allow, and never more than its owner's role in that organisation. A token belongs to you and works in one organisation. Choose the smallest set of scopes the job needs. See Create an API token and pick scopes.

No. It is shown once. Revoke it and create a new one. Scopes cannot be edited afterwards either, so a token that lacks a scope also needs replacing. See Create an API token and pick scopes.

A token may make 60 requests a minute, and 10 a minute for the heavier operations. The limit is per token, so give each job its own. After a 429, wait for the time in the Retry-After header. See API conventions.

Slow work such as a deployment is asynchronous. The 202 answer includes a status_url, which you poll until the work finishes. Always send Accept: application/json. See API conventions for authentication, pages, errors and rate limits.

Call the deployment endpoint with a token that has sites:manage-deploys and sites:view, then poll the deployment and read its log. The article shows each request with curl. See List servers and sites and trigger actions through the API.

Compute an HMAC-SHA256, in hex, of the timestamp, a dot and the raw request body, using your webhook's secret as the key. Compare it with every v1 value in the X-SrvYard-Signature header. See Receive event webhooks and verify their signatures.