Dashboard API

This page documents the endpoints the bichito dashboard hits with your JWT. Use them when you want to script something the dashboard already does — bulk imports, custom reporting, internal tooling.

Every endpoint requires Authorization: Bearer <jwt> (see Auth). All access is scoped to teams the JWT's user owns; foreign IDs return 404.

Bichitos

GET    /api/v1/bugs-admin                       List, with filters.
GET    /api/v1/bugs-admin/{id}                  Full detail.
PATCH  /api/v1/bugs-admin/{id}                  Update status / severity / assignee.
DELETE /api/v1/bugs-admin/{id}                  Delete (cascade).
POST   /api/v1/bugs-admin/bulk                  Bulk op on up to 500 ids.
GET    /api/v1/bugs-admin/export.csv            Stream CSV.
POST   /api/v1/bugs-admin/{id}/duplicate-of/{other_id}
DELETE /api/v1/bugs-admin/{id}/duplicate-of

GET /bugs-admin query parameters:

Param	Type	Notes
project_id	int	Honeycomb id.
status	enum	open/in_progress/resolved/closed/wont_fix/spam.
severity	enum	low/medium/high/critical.
assignee_id	int / me / none
label_id	int (repeatable)	AND-joined; bichito must have all listed labels.
search	string	Postgres FTS prefix-match in prod, ILIKE in dev.
limit	int	Default 50, max 200.
offset	int	For pagination.

Bulk op shape:

POST /api/v1/bugs-admin/bulk
{
  "ids": [1, 2, 3],
  "operation": "set_status",   // set_status | set_severity | assign | add_label | remove_label | mark_spam | delete
  "value": "resolved"          // shape depends on operation
}

Returns { "affected": <int> }. IDs not visible to the JWT's user are silently dropped.

Comments

GET    /api/v1/bugs-admin/{id}/comments         List.
POST   /api/v1/bugs-admin/{id}/comments         Create.
PATCH  /api/v1/bugs-admin/{id}/comments/{cid}   Edit (your own only).
DELETE /api/v1/bugs-admin/{id}/comments/{cid}   Delete (your own only).

body is 1–10,000 chars. Editing a comment leaves an edited_at timestamp; deleting leaves an activity row but removes the comment row.

Labels (per-team catalogue)

GET    /api/v1/teams/{team_id}/labels           List the catalogue.
POST   /api/v1/teams/{team_id}/labels           Create. Body: { name, color }.
PATCH  /api/v1/teams/{team_id}/labels/{id}      Rename / recolor.
DELETE /api/v1/teams/{team_id}/labels/{id}      Delete (cascade detach).

POST   /api/v1/bugs-admin/{bug_id}/labels/{label_id}    Attach.
DELETE /api/v1/bugs-admin/{bug_id}/labels/{label_id}    Detach.

Color is #RRGGBB. Names are unique per team.

Projects (honeycombs)

GET    /api/v1/projects                          List the user's projects across all teams.
GET    /api/v1/projects?team_id={id}             Filter to one team.
POST   /api/v1/projects                          Create. Body: { team_id, name, description? }.
GET    /api/v1/projects/{id}                     Detail (includes the api_key).
PATCH  /api/v1/projects/{id}                     Update name / description / allowed_origins / notification_emails.

Additional API keys for a project (the multi-key surface):

GET    /api/v1/projects/{id}/api-keys            List (without plaintext).
POST   /api/v1/projects/{id}/api-keys            Mint. Body: { name }. Returns plaintext once.
PATCH  /api/v1/projects/{id}/api-keys/{key_id}   Rename.
DELETE /api/v1/projects/{id}/api-keys/{key_id}   Revoke.

Teams (hives)

GET    /api/v1/teams                             List.
GET    /api/v1/teams/{id}                        Detail.
PATCH  /api/v1/teams/{id}                        Update name / slug.
GET    /api/v1/teams/{id}/stats?range=week|month|all
                                                 Aggregate counts for the dashboard summary.

Saved views

GET    /api/v1/teams/{id}/saved-views            List the caller's views in this team.
POST   /api/v1/teams/{id}/saved-views            Create. Body: { name, filters, is_pinned? }.
PATCH  /api/v1/teams/{id}/saved-views/{view_id}  Rename / repin / refilter.
DELETE /api/v1/teams/{id}/saved-views/{view_id}

Cap of 20 per (user, team). Filters JSON shape mirrors the inbox URL — q, status, severity, assignee, project, label[]. Unknown keys are rejected.

Blocklist

GET    /api/v1/projects/{id}/blocklist           List rules.
POST   /api/v1/projects/{id}/blocklist           Create. Body: { kind, value, reason? }.
DELETE /api/v1/projects/{id}/blocklist/{rule_id} Remove.

kind is one of email, ip, user_agent, keyword. See Blocklist for matching semantics.

Webhooks

GET    /api/v1/projects/{id}/webhooks                    List.
POST   /api/v1/projects/{id}/webhooks                    Create. Body: { url, events, transform? }.
PATCH  /api/v1/projects/{id}/webhooks/{wid}              Edit.
DELETE /api/v1/projects/{id}/webhooks/{wid}              Revoke.
GET    /api/v1/projects/{id}/webhooks/{wid}/deliveries   Per-delivery log.
POST   /api/v1/projects/{id}/webhooks/{wid}/test         Send a synthetic delivery to confirm wiring.

events is a non-empty array of bug.created / bug.updated / bug.commented. transform is raw (default), slack, or discord.

OpenAPI

The full set is browsable at /docs on the API host (FastAPI auto-generates it). For prod that's bichito-api.fly.dev/docs. Useful when you want a try-it-now playground.