Skip to content
GitmoapAPIBeta
Shipcatalog
POST/groups/{group_id}/catalog/scorecards

Declare a scorecard on a group

create_scorecard
  • catalog:manage
    A token needs the catalog:manage scope: Declare, edit and delete catalog servicesGranted by write_api.Every operation this scope unlocks
  • Audited · mutation

    x-gitmoap-audit: {"kind":"audited","arg":"mutation"}

  • Quota · scorecards per scope

    x-gitmoap-quota: {"kind":"enforced","arg":"scorecards_per_scope"}

A scorecard is a set of checks, and optionally named levels built from them, that every matching service in this group and the groups beneath it is measured against. Maintainers and above may declare one, but only the group's Owners may create it with its campaign armed, since an armed campaign files work items in every owning team's backlog. The slug must be unique here, each level may only require checks the scorecard carries, and the number of scorecards is capped by the plan.

Parameters

Path
  • group_idGroupId (string · uuid)The owning group's id

Request body

application/json
  • slugScorecardSlug (string)
  • applies_toServiceSelectoroptional
    • The ServiceSelector schema
    • annotationsobjectoptionalAnnotations a service must carry, as key–value pairs. Every entry must match; a service with extra annotations still matches.
    • kindsarray of ServiceKind: one of service | library | website | job | datastore | api | ml_model | otheroptional
    • lifecyclesarray of ServiceLifecycle: one of experimental | production | deprecated | retiredoptional
  • campaign_activebooleanoptionalWhether to switch the campaign on from the start. Setting it to true requires the Owner role.
  • campaign_max_itemsinteger · int32 or nulloptional0–∞How many work items the campaign may file each time it is switched on. Defaults to 200; at most 1,000.
  • checksarray of ScorecardCheckoptional
    • The ScorecardCheck schema
    • keyCheckKey (string)The built-in check's key for a derived check; your own name for the check otherwise.
    • ruleCheckRule
    • configobjectoptionalThe check's own parameters, such as {"days": 90} for released_within. An unknown parameter is refused with a 400 rather than ignored.
    • creates_work_itembooleanoptionalWhether a failure opens a work item in the owning group's backlog. Off by default, and it takes effect only while the scorecard's campaign is active.
  • descriptionstring or nulloptional
  • enabledbooleanoptional
  • levelsarray of ScorecardLeveloptional
  • namestring or nulloptionalDefaults to the slug.
Request body exampleSynthesized example
{
"slug": "slug-dc9e"
}

Responses

201The scorecard was declaredapplication/json
  • applies_toServiceSelector
    • The ServiceSelector schema
    • annotationsobjectoptionalAnnotations a service must carry, as key–value pairs. Every entry must match; a service with extra annotations still matches.
    • kindsarray of ServiceKind: one of service | library | website | job | datastore | api | ml_model | otheroptional
    • lifecyclesarray of ServiceLifecycle: one of experimental | production | deprecated | retiredoptional
  • campaign_activebooleanWhether the scorecard's campaign is on. Checks that open work items on failure do so only while it is.
  • campaign_enforcedbooleanWhether the platform acts on campaign_active. Always true.
  • campaign_item_countinteger · int320–∞How many work items the campaign has filed since it was last switched on. Read-only.
  • campaign_max_itemsinteger · int320–∞How many work items the campaign may file each time it is switched on. The count starts from zero every time campaign_active is turned on.
  • checksarray of ScorecardCheck
    • The ScorecardCheck schema
    • keyCheckKey (string)The built-in check's key for a derived check; your own name for the check otherwise.
    • ruleCheckRule
    • configobjectoptionalThe check's own parameters, such as {"days": 90} for released_within. An unknown parameter is refused with a 400 rather than ignored.
    • creates_work_itembooleanoptionalWhether a failure opens a work item in the owning group's backlog. Off by default, and it takes effect only while the scorecard's campaign is active.
  • created_atstring
  • enabledboolean
  • namestring
  • scopeScopeRefThe owning scope — a group or a repository.
  • scorecard_idScorecardId (string · uuid)
  • slugScorecardSlug (string)
  • updated_atstring
  • versioninteger · int64The scorecard's revision, incremented on every change. Send it with an update to have the update refused with a 409 if someone changed the scorecard since you read it.
  • created_byActorSummary or nulloptional
  • descriptionstring or nulloptional
  • levelsarray of ScorecardLeveloptional
201 exampleSynthesized example
{
"applies_to": {
"annotations": {},
"kinds": [
"service",
"service"
],
"lifecycles": [
"experimental"
]
},
"campaign_active": false,
"campaign_enforced": false,
"campaign_item_count": 5,
"campaign_max_items": 25,
"checks": [
{
"key": "key-6633",
"rule": {
"type": "derived"
}
},
{
"key": "key-940e",
"rule": {
"type": "derived"
}
}
],
"created_at": "2026-10-16T15:10:26Z",
"enabled": true,
"name": "payments-api",
"scope": {
"group": "4c1d8e2f-6a3b-4f90-b7c5-1e2d3c4b5a69"
},
"scorecard_id": "85331205-40e9-4469-bb11-7283747e553a",
"slug": "slug-4622",
"updated_at": "2026-10-08T11:38:49Z",
"version": 6,
"created_by": {
"email": "mara@acme.example",
"id": "id-cf7c",
"username": "mara",
"avatar_url": "https://gitmoap.example/acme/45f2f5c7"
},
"description": "Renders each region as density contours of its operations.",
"levels": [
{
"name": "payments-api",
"required_check_keys": []
},
{
"name": "payments-api",
"required_check_keys": []
}
]
}
400Validation error, an unimplemented derived check, or a level requiring a check the scorecard does not carryapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • INVALID_BINDINGThe criterion binding is not well-formed
  • RESERVED_CHECK_KEYThe key names a check the platform implements; a check you report needs a key of its own
  • UNKNOWN_CHECKThe key names no check the platform implements
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-c41c",
"message": "Stream pipeline status into the run header"
}
}
401Unauthenticated — no credential, or an invalid oneapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-5a91",
"message": "Inline scalar newtypes but keep their brand"
}
}
403Insufficient standing on the group, or Owner required to arm a campaignapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-fc64",
"message": "Stream pipeline status into the run header"
}
}
404No such groupapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-d9c0",
"message": "Stream pipeline status into the run header"
}
}
409The slug is already taken in this scopeapplication/json
Error codes
  • CONFLICTThe request conflicts with the resource's current state; reason says how
  • LEGAL_ACCEPTANCE_REQUIREDAccept the current Terms of Service before changing anything; reading stays open
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
409 exampleSynthesized example
{
"error": {
"code": "code-c37c",
"message": "Pin a page's payload to the build that rendered it"
}
}
429The namespace is at its scorecard limitapplication/json
Error codes
  • TOO_MANY_REQUESTSRetryableA quota, a rate limit or a transfer budget is spent. When the response carries Retry-After, retry after that many seconds
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
429 exampleSynthesized example
{
"error": {
"code": "code-a3ec",
"message": "Stream pipeline status into the run header"
}
}

CLI

gitmoap catalog create-scorecard

  • --group-ididThe owning group's id (id or group path)
  • --applies-tojsonoptional
  • --campaign-activeflagoptionalWhether to switch the campaign on from the start. Setting it to `true` requires the Owner role.
  • --campaign-max-itemsnumberoptionalHow many work items the campaign may file each time it is switched on. Defaults to 200; at most 1,000.
  • --checksjsonoptional
  • --descriptionstringoptional
  • --enabledflagoptional
  • --levelsjsonoptional
  • --namestringoptionalDefaults to the slug.
  • --slugstring

Used in these guides