Overview
Holden API (0.1.0)
Section titled “Holden API (0.1.0)”Holden exposes two HTTP servers:
- Port 6020 (public): Webhooks and management API via Traefik
- Port 6021 (internal): Same management API, plus
/api/decrypt. Localhost only (SSH-tunneled for remote access).
Both servers share the /api/ routes. On port 6020, /api/* routes require
a Bearer token (HOLDEN_API_KEY). On port 6021, no authentication is needed.
If HOLDEN_WEBHOOK_SECRET or HOLDEN_API_KEY is not configured, their
respective routes return 503 Service Unavailable. Both must be at least
32 characters if set.
- OpenAPI version: 3.1.0
Authentication
Section titled “ Authentication ”webhookSignature
Section titled “webhookSignature ”HMAC-SHA256 signature using HOLDEN_WEBHOOK_SECRET
Security scheme type: apiKey
Header parameter name: X-Hub-Signature-256
bearerToken
Section titled “bearerToken ”HOLDEN_API_KEY value. Required on port 6020 for /api/* routes.
Not required on port 6021.
Security scheme type: http