v7

latestOpenAPI 3.1.02026-08-06211328764.1 KB

Models

Rotate commit signing key

Rotate the commit signing keypair for a GitHub App connection and return the git configuration with the new commitSigningPublicKey to register on the committer’s GitHub user. Omni mints a fresh Ed25519 keypair unless signingPrivateKey supplies your own (with signingKeyPassphrase when encrypted), enabling zero-downtime rotation: register the matching public key on GitHub first, then set it here. The committer identity can be changed in the same call, so signing can be moved to a different GitHub user in one step. Commits already signed with the old key stay Verified only while the old public key remains registered on GitHub. Only valid for github_app auth.

post/api/v1/models/{modelId}/git/rotate-signing-key

Path parameters

modelIdstring uuid required

Model UUID

Example:123e4567-e89b-12d3-a456-426614174000

Model UUID

Request body

commitSigningCommitterEmailstring email nullable

Verified email of the GitHub user that owns the registered signing key, written into signed commits (github_app auth only). Send a string to set it, null to clear it (disabling signing), or omit it to leave the stored value unchanged. Must be set, cleared, or omitted together with commitSigningCommitterName.

commitSigningCommitterNamestring nullable

Display name written into signed commits (github_app auth only). Send a string to set it, null to clear it (disabling signing), or omit it to leave the stored value unchanged. Must be set, cleared, or omitted together with commitSigningCommitterEmail.

signingKeyPassphrasestring

Passphrase for signingPrivateKey when it is encrypted. Omni uses it once to decrypt the key, then stores the key under its own encryption at rest; the passphrase itself is not retained.

signingPrivateKeystring

Bring-your-own ED25519 signing private key in PEM format (as produced by ssh-keygen -t ed25519), used instead of an Omni-generated keypair. Enables zero-downtime rotation: register the matching public key on the GitHub user first, then set it here. RSA keys are rejected — commit signing is SSHSIG over ED25519. Must be non-blank when provided; omit it to have Omni mint a fresh keypair.

Example request

{
  "commitSigningCommitterEmail": "omni-bot@example.com",
  "commitSigningCommitterName": "Omni Bot"
}

Response

Signing key rotated; response includes the new public key

authMethod'ssh' | 'https_token' | 'github_app' required

Authentication method. "ssh" for deploy key, "https_token" for deploy token/PAT, "github_app" for a GitHub App installation.

baseBranchstring required

The target branch for Omni pull requests

branchPerPullRequestboolean required

If true, all pull requests will create a branch in Omni, even those created outside of the tool

cloneUrlstring required

Clone URL of the git repository (SSH or HTTPS)

commitSigningCommitterEmailstring nullable required

Committer email written into signed commits (github_app auth). Null when signing is not configured.

commitSigningCommitterNamestring nullable required

Committer display name written into signed commits (github_app auth). Null when signing is not configured.

commitSigningPublicKeystring nullable required

SSHSIG signing public key to register on the committer’s GitHub user (github_app auth). Null for other auth methods.

gitFollowerboolean required

If true, the shared model is read-only and can only be updated by merging pull requests to the base branch

gitServiceProviderstring required

The git provider type

githubAppInstallationIdstring nullable required

GitHub App installation ID. Null unless github_app auth.

modelPathstring nullable required

Path to model files in the repository

publicKeystring nullable required

SSH public key for repository access (deploy key). Null for HTTPS token auth.

requirePullRequest'always' | 'users-only' | 'never' required

When pull requests are required: "always" for all changes, "users-only" for user-initiated changes only, "never" for direct commits.

sshUrlstring required

Deprecated — use cloneUrl. Clone URL of the git repository.

webUrlstring nullable required

Custom web URL for the git repository, or null if not set

webhookSecretstring

Webhook secret for signature verification. Only included if requested via ?include=webhookSecret

webhookUrlstring required

Webhook URL to configure in your git provider

Example response

{
  "authMethod": "ssh",
  "baseBranch": "main",
  "cloneUrl": "git@github.com:org/repo.git",
  "commitSigningCommitterEmail": "omni-bot@example.com",
  "commitSigningCommitterName": "Omni Bot",
  "commitSigningPublicKey": "ssh-ed25519 AAAA...",
  "gitServiceProvider": "github",
  "githubAppInstallationId": "12345678",
  "modelPath": "omni/my_model",
  "publicKey": "ssh-ed25519 AAAA...",
  "requirePullRequest": "users-only",
  "webUrl": "https://github.com/org/repo",
  "webhookUrl": "https://app.omni.co/api/webhooks/model/..."
}