Deployments API

This is the canonical reference for machine deploys. A GitHub Actions workflow exchanges its OIDC identity for a short-lived deploy token, then rolls out an image with that token, no Google sign-in required. See the GitHub OIDC guide for the end-to-end flow, or push directly to your private registry.

Machine deploy flow

The flow is three calls. First, exchange registry credentials for a short-lived registry token to push the image. Then exchange the workflow's OIDC identity for a deploy token scoped to one app. Finally, deploy the pushed image with that deploy token. The deploy endpoint below (/v1/containers/{containerId}/deploy) is the token-authenticated path used by CI. To trigger a deploy interactively while signed in with Google instead, use the project-scoped path on the Deploy API page.

curl -X GET "https://example.com/v1/registry/token"

{
  "token": "string",
  "expires_in": 300
}

{
  "error": "validation failed",
  "request_id": "01J9Z3K8QWERTYUIOP"
}

curl -X POST "https://example.com/v1/containers/497f6eca-6276-4993-bfeb-53cbbbba6f08/deploy-token" \  -H "Content-Type: application/json" \  -d '{    "oidc_token": "string"  }'

{
  "token": "string",
  "expires_in": 600
}

curl -X POST "https://example.com/v1/containers/497f6eca-6276-4993-bfeb-53cbbbba6f08/deploy" \  -H "Content-Type: application/json" \  -d '{    "image": "registry.alawadi.cloud/acme/web:sha-8f31c2a"  }'

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "image": "string",
  "status": "queued",
  "created_at": "2019-08-24T14:15:22Z"
}