API: Integrations ​

Connect your tools in both directions.

Integrations ​

See Integrations.

GET /v1/integrations ​

Needs a key tied to a person. Returns {"integrations": [{name, connected, detail, last_error}]} for slack, discord, webhook, linear and posthog. detail is a masked URL or a short description. last_error says why the last release delivery failed and how to fix it; it clears on the next successful delivery, test, reconnect or disconnect. Change management providers whose flags are on are listed too.

PUT /v1/integrations/{name} ​

Connects an integration. Owner only (with roles: integrations.manage). Integrations are included; feature availability, early access and required provider permissions still apply.

Change management providers ​

Beta, early access. Flags: jira, servicenow, teams, vanta, drata. Until your workspace has a provider's feature, connecting it answers 404 NOT_FOUND.

These providers take a settings object instead:

Credentials are tested when you connect and stored encrypted. Returns the integrations list.

DELETE /v1/integrations/{name} ​

Owner only (with roles: integrations.manage). Returns 204.

POST /v1/integrations/{name}/test ​

Sends a test notification, a webhook.test event for webhook, or checks the connection for notion, confluence and change management. Owner only (with roles: integrations.manage). Returns {"ok": true}, 404 NOT_FOUND if it isn't connected, or 502 UPSTREAM_ERROR with what to fix if the test failed. Each test is written to the audit log as integration.test or integration.test.failed.

POST /v1/integrations/linear/teams ​

Lists the Linear teams an API key can reach, so you can pick one before connecting. Owners and admins only. Send api_key; it isn't saved. Returns {"teams": [{id, key, name}]}. Use bumpkit integrations linear teams or the integrations_linear_teams MCP tool.

POST /v1/integrations/{name}/request ​

Asks for access to an integration that's coming soon: origin, gitlab, bitbucket or azure-devops. Read-only roles get 403 FORBIDDEN. Returns {"key", "status": "requested"}, or 404 NOT_FOUND for any other name or when your workspace already has it. Use bumpkit integrations request NAME or the integrations_request MCP tool.

Failed deliveries ​

Change management providers only, while their flag is on; any other name answers 404 NOT_FOUND. Use bumpkit integrations deliveries or the integrations_deliveries_list and integrations_deliveries_retry MCP tools.

OAuth authorization ​

Connects slack-app, jira (flag jira), notion or confluence (flag notion_confluence) with consent in the browser, so no secret passes through the API. Needs a personal key from an owner or admin; other keys get 403 FORBIDDEN. A provider whose flag is off gets 403 FEATURE_UNAVAILABLE. Use bumpkit integrations authorize and oauth-status, or the integrations_authorize and integrations_oauth_status MCP tools.

Slack app ​

Manage the Slack app once it's authorized. Needs a personal key from an owner or admin. Use bumpkit integrations slack-app, or the integrations_slack_app_channel, integrations_slack_app_posting and integrations_slack_app_disconnect MCP tools.

Webhook sources ​

Create the URLs that inbound webhooks receive on. {provider} is webhook, sentry, pagerduty, datadog, vercel, argocd or railway; the last five need their flag, and incident sources (webhook, sentry, pagerduty, datadog) also need forensics or release_health. These routes need a key tied to a person, and only owners and admins can change sources. Use bumpkit sources or the sources_list, sources_add, sources_set_secret and sources_remove MCP tools.

Repositories ​

Flag: github_app. Without it these answer 403 EARLY_ACCESS_REQUIRED. All of them need a key tied to a person. Use bumpkit repo list, verify, add and pulls list; the MCP tools are repo_list, repo_verify, repo_add and repo_pulls_list.

GET /v1/repositories ​

Repositories the workspace's GitHub App installations can reach. Returns workspace_id, workspace_name and repositories: each has repository, default_branch, workspace_id, workspace_name, installation_id and verified.

POST /v1/repositories/verify ​

Checks that this workspace can reach one repository. Send repository as owner/name. Returns one repository, as above.

POST /v1/repositories/connect ​

Owners and admins only. Send repository as owner/name, or {} to choose after connecting. Returns authorization_url, workspace_id and workspace_name. Open the URL in a browser to finish in GitHub.

GET /v1/repositories/pulls ​

Open pull requests in a connected repository. Query repository and limit (1 to 50, default 50). Returns repository, workspace_id, workspace_name and pulls: each has number, title, draft, user, head and base.

Inbound webhooks ​

These endpoints receive events from other services. They don't take an API key: a token in the path picks the source, and a signature proves the sender. An unknown token, or a feature that is off, returns 404. A bad signature returns 401 INVALID_SIGNATURE.

POST /hooks/errors/{token} ​

Beta, early access. Flag: release_health.

Sends production errors for release health. Create a source on the dashboard's Integrations page: you get the URL and, for a generic webhook, a secret shown once.

Generic body: one event, or {"events": [...]} with 1 to 500 events.

Each event needs at least one of type, message, fingerprint or frames.

body='{"events":[{"type":"TypeError","message":"x is undefined","environment":"production","version":"v2.3.0","frames":[{"file":"src/cart.ts","line":42}]}]}'
sig=$(printf '%s' "$body" | openssl dgst -sha256 -hmac "$SECRET" | sed 's/^.* //')
curl https://bumpkit.dev/hooks/errors/$TOKEN \
  -H "Content-Type: application/json" \
  -H "X-Bumpkit-Signature: sha256=$sig" \
  -d "$body"

Returns 202 {"recorded": n}. Limited to 600 requests per minute per source; batch events. The body limit is 1 MB.

POST /hooks/incidents/{token} ​

Beta, early access. Flags: forensics or release_health.

Opens an incident from an alert and traces it to a release. Uses the same sources and signatures as /hooks/errors.

Generic body: title, url, id, started_at (RFC 3339), and error (with its stack trace) or files. Sentry sends event_alert and new issue events; others are ignored with 204.

With change management (Beta, flags pagerduty and datadog) two more sources are available:

Returns 202. The body limit is 1 MB.

POST /hooks/deploys/{token} ​

Beta, early access. Flags: vercel_deploys, argocd_deploys, railway_deploys.

Records deployments from your deploy platform, as POST /v1/deployments does. Create the source on the Integrations page.

Returns 204. Limited to 600 requests per minute per IP.

POST /hooks/gate/{provider}/{token} ​

Runs the gate on GitLab merge requests, and on Bitbucket, Azure DevOps and GitHub Enterprise Server pull requests. POST /v1/gate/connections returns the URL and secret.

Actionable events return 202 and the gate runs in the background, reporting a "Bumpkit release gate" status and a comment. Other events return 204. Limited to 600 requests per minute per IP; the body limit is 5 MB.

Outbound notifications ​

When an integration is connected, a successful POST /v1/analyze fires a release notification to Slack, Discord, Linear, PostHog and the outbound webhook. Notifications are fire-and-forget: a failure never affects the API response.

The Slack message uses Block Kit: a header with the new version, fields for bump type and repository (when repository was sent), and the changelog, cut at 2,900 characters to fit Slack's block limit.