Gitlab V2

GitLab's REST API covers the full DevSecOps lifecycle — repositories, issues, merge requests, CI/CD pipelines, security scan results (SAST, DAST, dependency scanning), container registry, releases, and group/project management. For agents: trigger pipeline runs, query pipeline status and job logs, manage merge request approvals, retrieve security vulnerability findings, create issues from automated scans, and manage project members. Both GitLab.com and self-hosted GitLab share the same API surface. Project access tokens enable per-project service credentials without user accounts. Confidence is docs-derived.

REST API at {gitlab_host}/api/v4. Resources: projects, issues, merge_requests, pipelines, jobs, releases, registry, groups, users. GET /projects/{id}/pipelines lists pipelines. POST /projects/{id}/pipeline triggers a pipeline ({ref, variables}). GET /projects/{id}/pipelines/{id}/jobs lists pipeline jobs. GET /projects/{id}/jobs/{id}/trace retrieves job log. GET /projects/{id}/issues creates an issue ({title, description, labels}). POST /projects/{id}/merge_requests creates an MR. GET /projects/{id}/vulnerabilities retrieves security findings. GET /projects/{id}/releases lists releases. POST /projects/{id}/releases creates a release ({name, tag_name, description, assets}). Pagination: X-Next-Page header + ?page=&per_page= params.

Three token types: (1) PAT: PRIVATE-TOKEN: {token} header. From GitLab Profile → Access Tokens (scopes: api, read_repository, write_repository, etc.). (2) Project/Group access tokens: scoped to project or group — ideal for CI/CD service accounts. (3) OAuth2: authorization code for user-delegated access. Self-hosted: same auth model. Job tokens (CI_JOB_TOKEN): pipeline jobs automatically receive a limited-scope token for API calls within the same project. HTTPS enforced.

Standard HTTP status codes with JSON error bodies ({message: "...", error: "..."}). 404 for private project without access. 403 for missing permission. Rate limiting: 2000 requests/minute (authenticated, GitLab.com). Request-per-minute header: RateLimit-Remaining. CI/CD triggers: async — poll pipeline status after trigger. Pipeline duration varies widely by CI configuration. GitLab uptime at status.gitlab.com. Self-hosted: operator-managed. Webhook delivery: configurable per-project/group with retry.

docs.gitlab.com/ee/api is comprehensive — full REST API reference, authentication guide, CI/CD API reference, security API reference, and pagination guide. Getting started: GitLab account (free tier), create PAT, first API call in under 2 minutes. python-gitlab (pip install python-gitlab) SDK for Python. Node.js: @gitbeaker/node. GitLab CLI (glab) for command-line API access. Community via GitLab Forum and GitLab Discord. Self-hosted GitLab documentation mirrors the API exactly, with version-specific notes.