Proves that the caller owns a repository — or a whole OWNER — and records the…
Proves that the caller owns a repository — or a whole OWNER — and records the claim, which is what makes deploys of that code earn royalty.
POST /v1/author/repos/verify
| Address | https://api.hanzo.ai/v1/author/repos/verify |
| Method | POST |
| Operation | post_author_repos_verify |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Proves that the caller owns a repository — or a whole OWNER — and records the claim, which is what makes deploys of that code earn royalty.
Ownership is proven the SAME two ways in both cases, tried in order: an IAM-linked forge token with admin or push permission, or a hanzo.json on the default branch carrying the author's verify code. Claiming an OWNER proves it against that owner's ".github" control repository, and is exactly as strong as a per-repository claim — an owner the caller cannot prove is refused with 422, never assumed.
A per-repository claim wins over an owner-wide one, so a specifically-claimed repository always earns for its own author. A repository another author has already verified is a 409. The org must have connected first.
Answers 201 when it recorded a new claim and 200 when the claim already existed.
Request
1 field, body application/json (required).
| Field | In | Type | Required | Description |
|---|---|---|---|---|
repoUrl | body | string | — | RepoURL is what to claim: a repository (github.com/owner/name) or a whole OWNER (github.com/owner, no repository segment). |
Response
| Status | Body | Meaning |
|---|---|---|
200 | claim | ok |
200 body — 15 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
created | body | boolean | — | Created reports whether this call recorded a new claim (201) or found an existing one (200). |
org | body | orgView | — | |
org.badgeMarkdown | body | string | — | BadgeMarkdown is the ready-to-paste README snippet, DERIVED for each response from this deployment's badge host and never stored — here it deep-links the… |
org.createdAt | body | integer | — | CreatedAt is unix seconds when the owner claim was first recorded — equal to verifiedAt on the first proof, then fixed while verifiedAt moves. |
org.method | body | string | — | Method is HOW the owner was proven, always against its ".github" control repository: "oauth" — an IAM-linked forge token showed admin or push on it; or "file"… |
org.ownerUrl | body | string | — | OwnerURL is the claim key in canonical form — lowercased "host/owner" with NO repository segment, host ∈ {github.com, gitlab.com}. |
org.verified | body | boolean | — | Verified reports that ownership of the WHOLE owner was proven — against that owner's ".github" control repository, which is exactly as strong as a… |
org.verifiedAt | body | integer | — | VerifiedAt is unix seconds of the most recent successful proof of the owner; re-verifying refreshes it, and the method beside it, in place. |
repo | body | authorRepo | — | |
repo.badgeMarkdown | body | string | — | BadgeMarkdown is the ready-to-paste README snippet, DERIVED for each response from this deployment's badge host and never stored: a "Deploy on Hanzo" image… |
repo.createdAt | body | integer | — | CreatedAt is unix seconds when the claim was first recorded. |
repo.method | body | string | — | Method is HOW ownership was proven: "oauth" — an IAM-linked forge token showed admin or push on the repository; "file" — a hanzo.json on the default branch… |
repo.repoUrl | body | string | — | RepoURL is the claim key in canonical form — lowercased "host/owner/name", no scheme, no .git, host ∈ {github.com, gitlab.com}. |
repo.verified | body | boolean | — | Verified reports that ownership was proven. |
repo.verifiedAt | body | integer | — | VerifiedAt is unix seconds of the most recent successful proof. |
Failure carries the platform error shape — see Errors.
Examples
hanzo authors repos verifyimport { Configuration, AuthorApi } from 'hanzoai';
const api = new AuthorApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.postAuthorReposVerify({ repoUrl: "<repoUrl>" });from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import AuthorApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = AuthorApi(client).post_author_repos_verify(repo_url="<repoUrl>")cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)
resp, _, err := client.AuthorAPI.PostAuthorReposVerify(context.Background()).Execute()
if err != nil {
return err
}use hanzo_cloud::apis::{configuration::Configuration, author_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = author_api::post_author_repos_verify(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.AuthorApi;
ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));
var result = new AuthorApi(client).postAuthorReposVerify();The method above is the one at the current release of the document. [email protected] (npm) and [email protected] (PyPI) were generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. SDKs →
curl -X POST https://api.hanzo.ai/v1/author/repos/verify \
-H "Authorization: Bearer $HANZO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"repoUrl": "<repoUrl>"
}'The door reaches author through the authors tool, which names its 11 operations with its own verbs — this one among them, under a name only the door declares. describe explains any of them:
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "describe",
"arguments": {
"op": "list_admin_authors"
}
}
}'How is this guide?