> ## Documentation Index
> Fetch the complete documentation index at: https://docs.artbucket.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Check a build hosted anywhere

> The body is a zip of a built site (`Content-Type: application/zip`), from a CI job that deploys it somewhere else: Vercel, Netlify, GitHub Pages. It is checked as a deployment would be, and nothing is stored: every file matched against the project's library by its bytes, every /a/ and /c/ address in its HTML, CSS and JS read, and the ids artbucket.site.json names. `allowed` is false when any of it may not be shown, with the reasons in `problems`.

Scope: `read`.



## OpenAPI

````yaml /openapi.json post /api/v1/sites/check
openapi: 3.1.0
info:
  title: artbucket
  version: '1'
  description: >-
    Agent-first asset management. The web UI is built on this API and nothing
    else, beside signing in at /api/auth. Send `Authorization: Bearer <key>`: a
    key works in one project with one scope, and scopes are a ladder: read <
    propose < write < admin. People signed in to the app carry a session cookie
    instead, and their scope is what their grants add up to: on the
    organization, the project, or single collections and assets. A scope shown
    as needed on the project is also enough on the one collection or asset a
    route acts on. Agents (MCP at POST /api/v1/mcp) usually get `propose`: what
    they add waits for a human.
servers:
  - url: http://localhost:3000
security:
  - bearer: []
  - session: []
  - {}
paths:
  /api/v1/sites/check:
    post:
      summary: Check a build hosted anywhere
      description: >-
        The body is a zip of a built site (`Content-Type: application/zip`),
        from a CI job that deploys it somewhere else: Vercel, Netlify, GitHub
        Pages. It is checked as a deployment would be, and nothing is stored:
        every file matched against the project's library by its bytes, every /a/
        and /c/ address in its HTML, CSS and JS read, and the ids
        artbucket.site.json names. `allowed` is false when any of it may not be
        shown, with the reasons in `problems`.


        Scope: `read`.
      requestBody:
        required: true
        content:
          application/zip:
            schema:
              type: string
              format: binary
      responses:
        '200':
          description: The verdict
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      allowed:
                        type: boolean
                      files:
                        type: integer
                        minimum: -9007199254740991
                        maximum: 9007199254740991
                      uses:
                        type: array
                        items:
                          type: object
                          properties:
                            asset:
                              type: string
                              format: uuid
                              pattern: >-
                                ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                            how:
                              type: string
                              enum:
                                - copy
                                - link
                                - current
                                - declared
                              description: >-
                                copy: a file is the asset's bytes; link:
                                /a/{id}; current: /c/{id}, the version it
                                served; declared: named by artbucket.site.json
                            file:
                              description: The build's file it was found in
                              type:
                                - string
                                - 'null'
                          required:
                            - asset
                            - how
                            - file
                          additionalProperties: false
                        description: >-
                          What it uses of the project's library, found in its
                          files: its lineage
                      problems:
                        type: array
                        items:
                          type: string
                        description: >-
                          Why what it uses may not be shown, each naming the
                          file and, for a replaced asset, its replacement
                      flags:
                        type: array
                        items:
                          type: string
                        description: >-
                          Signs it looks like phishing or malware (a page asking
                          for a password, a card or a recovery phrase; a program
                          to download), one line each
                    required:
                      - allowed
                      - files
                      - uses
                      - problems
                      - flags
                    additionalProperties: false
                required:
                  - data
                additionalProperties: false
        default:
          description: An error
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                      message:
                        type: string
                      detail: {}
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
components:
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: 'An API key: ab_...'
    session:
      type: apiKey
      in: cookie
      name: better-auth.session_token
      description: Signed in, at /api/auth

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.