Skip to content

VerifiedCliCall

method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'

HTTP method the request arrived on.


installRepo: string

<org>/<repo> slug of the install, from the install-repo header.

Only cryptographically bound under the signing scheme (the HMAC covers the install repo). Under token schemes (bearer / api-key / basic) it is caller-asserted — verifying the request does NOT prove the caller is entitled to this install. When the install repo drives authorization, bind it (resolve the per-install secret keyed by this value and verify with it) or require the signing scheme. See docs/dev/component-rules.md → “What each scheme binds”.


args: Record<string, string | number | boolean | undefined>

Method args — query params for GET, parsed JSON body for POST/PUT/PATCH.