Changes sent to the inbox over HTTP, by CI or another service: POST /changes of the JSON API (Tayori.API), with the ingest token.

curl -X POST https://myapp.com/api/machines/news/changes \
  -H "authorization: Bearer $TAYORI_INGEST_TOKEN" \
  -H "content-type: application/json" \
  -d '{"changes": [{"ref": "pr-1234", "title": "Exports in two clicks", "kind": "added"}]}'

The body is {"changes": [...]}, or {"change": {...}} for one: the attributes Tayori.Inbox.add/2 takes, with "source" "api" when they do not say. The answer counts them:

{"added": 1, "existing": 0, "errors": [{"index": 2, "errors": {"title": ["can't be blank"]}}]}

It is a 201 when any change was new, a 200 when none was, and a 422 when none could be added. A request has at most 500 changes, and a body of at most a megabyte (a 413). Without the token, or with another, it is a 401; while no token was ever made, a 404.

There is one token. The admin makes it, and sees it once: Tayori keeps only its SHA-256, and compares in constant time. Making a new one revokes the old.

mix tayori.ingest sends a changelog and fragments from CI. The Automation guide mounts the API for machines.