Read back a stored credential
curl --request POST \
--url https://api.benchgen.com/api/git-connections/{id}/use/import requests
url = "https://api.benchgen.com/api/git-connections/{id}/use/"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://api.benchgen.com/api/git-connections/{id}/use/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.benchgen.com/api/git-connections/{id}/use/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.benchgen.com/api/git-connections/{id}/use/"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.benchgen.com/api/git-connections/{id}/use/")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.benchgen.com/api/git-connections/{id}/use/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"valid": true,
"repo": "<string>",
"host": "<string>",
"branch": "<string>",
"token": "<string>"
}Git repositories
Read back a stored credential
The one endpoint that returns a credential, for doing git work as yourself. It is a POST because it stamps the connection with last_used_at, and because a secret has no business in a URL a proxy might log. It is rate limited, and it only ever serves the caller their own connection. Omit the id to get your default connection. Requires the repo:use scope, which is separate from repo:read precisely so that listing connections cannot leak one.
POST
/
api
/
git-connections
/
{id}
/
use
/
Read back a stored credential
curl --request POST \
--url https://api.benchgen.com/api/git-connections/{id}/use/import requests
url = "https://api.benchgen.com/api/git-connections/{id}/use/"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://api.benchgen.com/api/git-connections/{id}/use/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.benchgen.com/api/git-connections/{id}/use/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.benchgen.com/api/git-connections/{id}/use/"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.benchgen.com/api/git-connections/{id}/use/")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.benchgen.com/api/git-connections/{id}/use/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"valid": true,
"repo": "<string>",
"host": "<string>",
"branch": "<string>",
"token": "<string>"
}The one endpoint that returns a credential, so that a client can do git work as
you: clone, commit and push a benchmark’s files into your own repository.
Omit the id and you get your default connection, which is what a client with no
particular repository in mind should ask for.
curl -X POST "https://api.benchgen.com/api/git-connections/use/" \
-H "Authorization: Bearer $BENCHGEN_API_TOKEN"
Why it is shaped like this
Every decision here exists to keep the blast radius small.| Choice | Reason |
|---|---|
Its own scope, repo:use | Listing connections needs only repo:read, so the common path cannot leak a credential even when the token is over-broad |
| A POST, although it reads | It stamps last_used_at, and a secret in a URL ends up in proxy logs and browser history |
| One row, by id, never a search | There is no call that returns several credentials at once |
| Rate limited | Bounds what a leaked platform token can drain before anyone notices |
| Owner only | Enforced on the query, not after it, so another user’s id is simply not found |
Seeing when it was used
Every call stampslast_used_at on the connection, which
listing shows. If a credential
was handed out when you were not doing anything, that is worth acting on:
revoke it on the git host, then connect again with a fresh one.
The platform does not push for you. It hands back the credential and the
repository address; the clone, the commit and the push happen in the client,
which is what lets a private repository work without the platform holding
network access to it.
Related
Connect a repository
Store a repository and its access token.
List your connections
What is connected, and when each credential was last used.
Last modified on September 29, 2026