13 KiB
GitLab REST API Reference
Overview
The GitLab REST API provides programmatic access to GitLab resources. All API requests require authentication and return JSON responses.
Base URL
https://gitlab.com/api/v4
For self-hosted GitLab instances:
https://your-gitlab-instance.com/api/v4
Authentication
Personal Access Tokens (Recommended)
Include in request header:
PRIVATE-TOKEN: <your_access_token>
Or as query parameter:
?private_token=<your_access_token>
OAuth 2.0 Token
Include in request header:
Authorization: Bearer <oauth_token>
Job Token (CI/CD)
Use within GitLab CI/CD jobs:
JOB-TOKEN: <CI_JOB_TOKEN>
Rate Limiting
- Default: 2000 requests per minute per user
- Authenticated requests: counted per user
- Unauthenticated requests: counted per IP
- Response headers include rate limit info:
RateLimit-Limit: Request limitRateLimit-Remaining: Remaining requestsRateLimit-Reset: Reset time (Unix timestamp)
Common Parameters
Pagination
page: Page number (default: 1)per_page: Items per page (default: 20, max: 100)
Headers in response:
X-Total: Total number of itemsX-Total-Pages: Total number of pagesX-Per-Page: Items per pageX-Page: Current pageX-Next-Page: Next page numberX-Prev-Page: Previous page number
Filtering
search: Search by specific fieldsorder_by: Order results (e.g.,created_at,updated_at,name)sort: Sort direction (ascordesc)
Core API Resources
Projects
List all projects
GET /projects
Get project by ID
GET /projects/:id
Create project
POST /projects
Parameters:
name(required): Project namepath: Repository path (defaults to name)namespace_id: Namespace for projectdescription: Project descriptionvisibility:private,internal, orpublicinitialize_with_readme: Boolean
Update project
PUT /projects/:id
Delete project
DELETE /projects/:id
Fork project
POST /projects/:id/fork
List project members
GET /projects/:id/members
Add project member
POST /projects/:id/members
Parameters:
user_id(required): User IDaccess_level(required): 10 (Guest), 20 (Reporter), 30 (Developer), 40 (Maintainer), 50 (Owner)
Repository
List repository files
GET /projects/:id/repository/tree
Parameters:
path: Directory pathref: Branch/tag namerecursive: Boolean for recursive listing
Get file content
GET /projects/:id/repository/files/:file_path
Parameters:
ref(required): Branch/tag/commit
Create file
POST /projects/:id/repository/files/:file_path
Parameters:
branch(required): Branch namecontent(required): File contentcommit_message(required): Commit messageencoding:textorbase64
Update file
PUT /projects/:id/repository/files/:file_path
Delete file
DELETE /projects/:id/repository/files/:file_path
Get repository archive
GET /projects/:id/repository/archive
Commits
List commits
GET /projects/:id/repository/commits
Parameters:
ref_name: Branch/tag namesince: Start date (ISO 8601 format)until: End datepath: File path to filter commits
Get single commit
GET /projects/:id/repository/commits/:sha
Create commit
POST /projects/:id/repository/commits
Parameters:
branch(required): Branch namecommit_message(required): Commit messageactions(required): Array of actions
Action types:
create: Create filedelete: Delete filemove: Move fileupdate: Update filechmod: Change permissions
Get commit diff
GET /projects/:id/repository/commits/:sha/diff
Get commit comments
GET /projects/:id/repository/commits/:sha/comments
Branches
List branches
GET /projects/:id/repository/branches
Get single branch
GET /projects/:id/repository/branches/:branch
Create branch
POST /projects/:id/repository/branches
Parameters:
branch(required): Branch nameref(required): Source branch/tag/commit
Delete branch
DELETE /projects/:id/repository/branches/:branch
Protect branch
POST /projects/:id/protected_branches
Parameters:
name(required): Branch name or wildcardpush_access_level: 0 (No access), 30 (Developer), 40 (Maintainer)merge_access_level: Similar access levelsallow_force_push: Boolean
Merge Requests
List merge requests
GET /projects/:id/merge_requests
Parameters:
state:opened,closed,merged,allscope:created_by_me,assigned_to_me,allsource_branch: Filter by source branchtarget_branch: Filter by target branch
Get merge request
GET /projects/:id/merge_requests/:merge_request_iid
Create merge request
POST /projects/:id/merge_requests
Parameters:
source_branch(required): Source branchtarget_branch(required): Target branchtitle(required): MR titledescription: MR descriptionassignee_id: Assignee user IDreviewer_ids: Array of reviewer user IDslabels: Comma-separated label namesremove_source_branch: Boolean
Update merge request
PUT /projects/:id/merge_requests/:merge_request_iid
Accept/Merge MR
PUT /projects/:id/merge_requests/:merge_request_iid/merge
Parameters:
merge_commit_message: Custom merge messagesquash_commit_message: Squash commit messagesquash: Booleanshould_remove_source_branch: Boolean
Get MR changes
GET /projects/:id/merge_requests/:merge_request_iid/changes
Get MR commits
GET /projects/:id/merge_requests/:merge_request_iid/commits
Get MR approvals
GET /projects/:id/merge_requests/:merge_request_iid/approvals
Approve MR
POST /projects/:id/merge_requests/:merge_request_iid/approve
Issues
List issues
GET /projects/:id/issues
Parameters:
state:opened,closed,alllabels: Comma-separated label namesmilestone: Milestone titleassignee_id: Assignee user IDauthor_id: Author user ID
Get issue
GET /projects/:id/issues/:issue_iid
Create issue
POST /projects/:id/issues
Parameters:
title(required): Issue titledescription: Issue descriptionassignee_ids: Array of assignee IDslabels: Comma-separated labelsmilestone_id: Milestone IDdue_date: Due date (YYYY-MM-DD)weight: Issue weight
Update issue
PUT /projects/:id/issues/:issue_iid
Close issue
PUT /projects/:id/issues/:issue_iid
Parameters:
state_event:close
Delete issue
DELETE /projects/:id/issues/:issue_iid
Pipelines
List pipelines
GET /projects/:id/pipelines
Parameters:
ref: Branch/tag namestatus:running,pending,success,failed,canceled,skippedscope:running,pending,finished,branches,tags
Get pipeline
GET /projects/:id/pipelines/:pipeline_id
Create pipeline
POST /projects/:id/pipeline
Parameters:
ref(required): Branch/tag namevariables: Array of pipeline variables
Retry pipeline
POST /projects/:id/pipelines/:pipeline_id/retry
Cancel pipeline
POST /projects/:id/pipelines/:pipeline_id/cancel
Delete pipeline
DELETE /projects/:id/pipelines/:pipeline_id
Get pipeline variables
GET /projects/:id/pipelines/:pipeline_id/variables
Jobs
List project jobs
GET /projects/:id/jobs
Parameters:
scope:created,pending,running,failed,success,canceled,skipped,manual
Get pipeline jobs
GET /projects/:id/pipelines/:pipeline_id/jobs
Get job
GET /projects/:id/jobs/:job_id
Get job artifacts
GET /projects/:id/jobs/:job_id/artifacts
Download artifact file
GET /projects/:id/jobs/:job_id/artifacts/:artifact_path
Get job trace
GET /projects/:id/jobs/:job_id/trace
Retry job
POST /projects/:id/jobs/:job_id/retry
Cancel job
POST /projects/:id/jobs/:job_id/cancel
Erase job
POST /projects/:id/jobs/:job_id/erase
Play manual job
POST /projects/:id/jobs/:job_id/play
Users
List users
GET /users
Get user
GET /users/:id
Get current user
GET /user
Create user (Admin only)
POST /users
Update user
PUT /users/:id
Delete user (Admin only)
DELETE /users/:id
Groups
List groups
GET /groups
Get group
GET /groups/:id
Create group
POST /groups
Parameters:
name(required): Group namepath(required): Group pathdescription: Group descriptionvisibility:private,internal,public
Update group
PUT /groups/:id
Delete group
DELETE /groups/:id
List group members
GET /groups/:id/members
Add group member
POST /groups/:id/members
Runners
List runners
GET /runners
Get runner
GET /runners/:id
Update runner
PUT /runners/:id
Parameters:
description: Runner descriptionactive: Booleantag_list: Array of tagsrun_untagged: Booleanlocked: Booleanaccess_level:not_protected,ref_protected
Delete runner
DELETE /runners/:id
List project runners
GET /projects/:id/runners
Enable runner for project
POST /projects/:id/runners
Disable runner for project
DELETE /projects/:id/runners/:runner_id
Variables
List project variables
GET /projects/:id/variables
Get variable
GET /projects/:id/variables/:key
Create variable
POST /projects/:id/variables
Parameters:
key(required): Variable keyvalue(required): Variable valuevariable_type:env_varorfileprotected: Booleanmasked: Booleanenvironment_scope: Environment scope (default:*)
Update variable
PUT /projects/:id/variables/:key
Delete variable
DELETE /projects/:id/variables/:key
Webhooks
List project webhooks
GET /projects/:id/hooks
Get webhook
GET /projects/:id/hooks/:hook_id
Create webhook
POST /projects/:id/hooks
Parameters:
url(required): Webhook URLtoken: Secret tokenpush_events: Booleanissues_events: Booleanmerge_requests_events: Booleanwiki_page_events: Booleanpipeline_events: Booleanjob_events: Booleandeployment_events: Booleanenable_ssl_verification: Boolean
Update webhook
PUT /projects/:id/hooks/:hook_id
Delete webhook
DELETE /projects/:id/hooks/:hook_id
Test webhook
POST /projects/:id/hooks/:hook_id/test/:trigger
Triggers: push_events, issues_events, merge_requests_events, etc.
Tags
List tags
GET /projects/:id/repository/tags
Get tag
GET /projects/:id/repository/tags/:tag_name
Create tag
POST /projects/:id/repository/tags
Parameters:
tag_name(required): Tag nameref(required): Source commit SHAmessage: Tag messagerelease_description: Release description
Delete tag
DELETE /projects/:id/repository/tags/:tag_name
Releases
List releases
GET /projects/:id/releases
Get release
GET /projects/:id/releases/:tag_name
Create release
POST /projects/:id/releases
Parameters:
name(required): Release nametag_name(required): Tag namedescription: Release descriptionref: Commit SHA, branch, or tag (required if tag doesn't exist)milestones: Array of milestone titlesassets: Release assets
Update release
PUT /projects/:id/releases/:tag_name
Delete release
DELETE /projects/:id/releases/:tag_name
Error Handling
HTTP Status Codes
200 OK: Request successful201 Created: Resource created204 No Content: Successful deletion400 Bad Request: Invalid parameters401 Unauthorized: Authentication required403 Forbidden: Insufficient permissions404 Not Found: Resource not found409 Conflict: Resource conflict422 Unprocessable Entity: Validation error429 Too Many Requests: Rate limit exceeded500 Internal Server Error: Server error
Error Response Format
{
"message": "Error message",
"error": "error_type"
}
Validation errors:
{
"message": {
"field": ["error message"]
}
}
Best Practices
- Use Personal Access Tokens: More secure than OAuth for scripts and automation
- Handle Rate Limits: Implement exponential backoff for rate limit errors
- Use Pagination: For large datasets, implement proper pagination
- Cache Responses: Cache API responses when appropriate
- Error Handling: Always handle error responses gracefully
- Project IDs: Use URL-encoded project paths (e.g.,
namespace%2Fproject) - Webhooks: Use webhook tokens and verify SSL certificates
- Minimize Requests: Batch operations when possible
- Use Specific Scopes: Request only necessary API scopes
- Monitor Usage: Track API usage through rate limit headers
Additional Resources
- Official GitLab API Documentation: https://docs.gitlab.com/ee/api/
- API Libraries: Available for Python, Ruby, JavaScript, Go, etc.
- GraphQL API: Available at
/api/graphqlfor more efficient queries