HTTP API

Base URL: https://flypod.dev. Authenticated requests use Authorization: Bearer <token>, where the token is a per-site manage_token or a Better Auth account session token. See Tokens & ownership.

Endpoints

GET /healthz

Liveness check.

curl https://flypod.dev/healthz

{ "ok": true }

POST /sites

Deploy a new site. Send a zip of the site as the raw request body with content-type: application/zip. Anonymous unless you send an account session.

curl -X POST https://flypod.dev/sites \
  -H "content-type: application/zip" \
  --data-binary @site.zip

Send Authorization: Bearer <session_token> to make the deploy owned and permanent.

Returns the deploy JSON: url, site_id, version_id, expires_at, manage_token, optional claim_token, optional owner_account_id, next_actions, plus warnings and render info.

POST /sites/:id/deploys

Redeploy. Uploads a new version that becomes live. Requires a bearer token (manage_token or account session). Body is a zip.

curl -X POST https://flypod.dev/sites/<id>/deploys \
  -H "authorization: Bearer <manage_token>" \
  -H "content-type: application/zip" \
  --data-binary @site.zip

POST /sites/:id/rollback

Repoint the live site to a prior version. Requires a bearer token. JSON body with the target version_id.

curl -X POST https://flypod.dev/sites/<id>/rollback \
  -H "authorization: Bearer <manage_token>" -H "content-type: application/json" \
  -d '{"version_id":"<version_id>"}'

An unknown version returns 404 Unknown version.

GET /sites/:id

Returns the site record and its version list. Requires a bearer token.

curl https://flypod.dev/sites/<id> -H "authorization: Bearer <manage_token>"

POST /sites/:id/claim

Attach a single anonymous deploy to an account using its claim_token. Requires an authenticated identity and a valid claim_token (from the original anonymous deploy response).

curl -X POST https://flypod.dev/sites/<id>/claim \
  -H "authorization: Bearer <session_token>" -H "content-type: application/json" \
  -d '{"claim_token":"<claim_token>"}'

Rate-limited per IP. Most clients use POST /account/bulk-attach instead — see below.

POST /account/bulk-attach

Attach multiple anonymous sites to the caller's account in one request, using each site's manage_token as proof of ownership. This is the endpoint flypod login calls to auto-claim every anonymous site the local CLI remembers.

curl -X POST https://flypod.dev/account/bulk-attach \
  -H "authorization: Bearer <session_token>" -H "content-type: application/json" \
  -d '{"sites":[{"site_id":"abc","manage_token":"fk_..."},{"site_id":"def","manage_token":"fk_..."}]}'

Body: { sites: [{ site_id, manage_token }, …] }, 1 to 100 items. Returns:

{
  "attached": ["abc"],
  "skipped": [
    { "site_id": "def", "reason": "invalid_token" }
  ]
}

reason is one of not_found, already_owned, already_yours, invalid_token, or invalid_input. Rate-limited per IP.

Account

Serving behavior

Served responses carry:

cache-control: public, max-age=60, must-revalidate

The ETag is "<live_version_id>:<path>".