Skip to main content
The registry exposes a versioned HTTP API. The open-source CLI is its reference consumer; anything the CLI does, you can do directly.

​
Authentication

All endpoints authenticate with a device token unless noted otherwise:
Tokens are lifetime, per-device, and issued by the device authorization flow. The server stores only a sha256 hash of each token. A 401 means the token is invalid or the device was revoked — obtain a new one via masterskills login. A few endpoints (device approval, organization creation) are panel-session endpoints — they require a signed-in browser session at masterskills.dev, not a device token. They are marked where they appear.

​
Conventions

  • Request and response bodies are JSON.
  • Errors use one envelope, with a proper HTTP status:
  • Skills and kits are addressed as @org/slug; the organizations.slug is the namespace, stored without the @. Reads span all organizations the token’s user belongs to; a pending (unapproved) membership grants no access anywhere.

​
Endpoints