Quickbox

Control URL: https://quickbox.hypeship.sh
OpenAPI: https://quickbox.hypeship.sh/openapi.json
Authentication: https://quickbox.hypeship.sh/auth.md
App URL format: https://{slug}.quickbox-apps.hypeship.sh

Quickbox stores source in one Code Storage Git repository per app. A commit produces an isolated Hypeman build and a digest-pinned OCI image. A release starts that image without deployment-time dependency installation and automatically replaces the current runtime after passing its health check.

Apps are internal or private. Internal apps grant every authenticated organization user read or write access; private apps grant access only to explicit members. Read access allows viewing and cloning. Write access also allows pushing, building, and releasing. Owners retain app administration.

Access app URLs programmatically with `Authorization: Bearer <api-key>`. Interactive browsers use a Quickbox web-session cookie; an API key does not automatically authenticate a fresh browser unless its bearer header is injected.

App owners can expose exact path and HTTP method pairs without Quickbox authentication. The workload remains responsible for authenticating and validating public requests. Replace the complete allowlist with `PUT /v1/apps/{app_id}/public-ingress`; query parameters do not affect path matching. Quickbox preserves webhook signature headers but removes `Authorization` and its session cookie before proxying:
curl -sS -X PUT https://quickbox.hypeship.sh/v1/apps/{app_id}/public-ingress \
  -H 'Authorization: Bearer <api-key>' \
  -H 'Content-Type: application/json' \
  -d '{"rules":[{"path":"/webhooks/provider","methods":["POST"]}]}'

Create an app:
curl -sS -X POST https://quickbox.hypeship.sh/v1/apps \
  -H 'Authorization: Bearer <api-key>' \
  -H 'Content-Type: application/json' \
  -d '{"name":"example","description":"example quickbox app.","slug":"example"}'

Contribute to an existing app:
1. GET /v1/apps and confirm the intended app ID and slug. Organization-accessible apps are included; never overwrite one only because its slug matches.
2. GET /v1/apps/{app_id}/repository and use its default branch, normally main. GET /v1/apps/{app_id}/releases and record the active release ID before making changes.
3. Issue a short-lived Git credential, then use its clone_url, username, and password to clone or pull:
curl -sS -X POST https://quickbox.hypeship.sh/v1/apps/{app_id}/repository/credentials \
  -H 'Authorization: Bearer <api-key>'
4. Make focused changes and commit. Before pushing, run git pull --rebase origin <default-branch> and resolve conflicts locally.
5. Push normally. Quickbox credentials reject force pushes; never discard remote changes or replace an existing source tree from a stale directory.
6. Queue a build for the pushed commit SHA. A push alone does not build or deploy, and builds are not tied to a branch name.
7. After the build succeeds, create its release. A healthy release automatically replaces the previous runtime; users with write access can complete this step and app administration remains restricted to the owner.

The Quickbox deploy helper replaces the complete source tree and creates a release. Reserve it for an intentional full deployment rather than a focused contribution to an existing app.

Build an immutable commit:
curl -sS -X POST https://quickbox.hypeship.sh/v1/apps/{app_id}/builds \
  -H 'Authorization: Bearer <api-key>' \
  -H 'Content-Type: application/json' \
  -d '{"commit":"{40 lowercase hex characters}","dockerfile":"Dockerfile","context":".","platform":"linux/amd64"}'

Poll the build until it succeeds, then create a release. Set expected_active_release_id to the active release recorded before making changes; omit it only when the app had no active release. A stale deployment fails instead of replacing a release that became active in the meantime:
curl -sS -X POST https://quickbox.hypeship.sh/v1/apps/{app_id}/releases \
  -H 'Authorization: Bearer <api-key>' \
  -H 'Content-Type: application/json' \
  -d '{"build_id":"{build_id}","expected_active_release_id":"{active_release_id}","port":3000,"health_check":{"path":"/health","timeout_seconds":120}}'