Hub API

The Hub speaks a small REST API. The CLI uses it; you can too. Base URL: https://userig.xyz/api/v1 (or {RIG_HUB_URL}/api/v1).

CORS allows requests from the Hub UI, the workers domain, and localhost:3000.

`GET /packages`

List or search packages.

curl https://userig.xyz/api/v1/packages
curl 'https://userig.xyz/api/v1/packages?q=research'

Response:

{
  "packages": [
    {
      "author": "maria",
      "name": "market-researcher",
      "latest_version": "1.2.0",
      "description": "Equity research workspace with yfinance + macro MCPs."
    }
  ]
}

Query params:

Param	What
`q`	Match name, author, description.

`GET /packages/{author}/{name}`

Package metadata.

curl https://userig.xyz/api/v1/packages/maria/market-researcher

Response includes the latest version, description, and version list.

`GET /packages/{author}/{name}/{version}/artifact`

Download the .rig.tgz for a specific version. Sends X-Rig-SHA256 response header — clients should verify.

curl -L -O https://userig.xyz/api/v1/packages/maria/market-researcher/1.2.0/artifact

`GET /packages/{author}/{name}/stats`

Per-package statistics (install counts, view counts).

curl https://userig.xyz/api/v1/packages/maria/market-researcher/stats

`POST /packages/{author}/{name}/versions`

Publish a new version. Authenticated.

curl -X POST \
  -H "Authorization: Bearer <token>" \
  -H "X-Rig-Version: 1.2.0" \
  -H "X-Rig-Manifest: <json>" \
  -H "X-Rig-Readme: <base64>" \
  --data-binary @artifact.rig.tgz \
  https://userig.xyz/api/v1/packages/maria/market-researcher/versions

Header	What
`Authorization: Bearer <token>`	Hub auth token from `rig login`.
`X-Rig-Version`	The version being published (must match manifest).
`X-Rig-Manifest`	The manifest as JSON.
`X-Rig-Readme`	The README, base64-encoded. Optional.

{author} in the URL must match the authenticated user.

This is what rig hub publish calls. You won't typically call it directly.

`GET /me`

Authenticated user info.

curl -H "Authorization: Bearer <token>" https://userig.xyz/api/v1/me

Response: { id, username, email }.

`GET /auth/device`

Device-flow login UI. Renders an HTML page that prompts the user to authorise a device code.

rig login opens this in your browser as part of the OAuth dance. Not a machine endpoint.

Errors

Status	Common cause
`400`	Malformed request.
`401`	Missing or invalid auth token.
`403`	Authorised but not allowed (e.g. publishing under someone else's `author`).
`404`	Package or version not found.
`409`	Version already exists. Bump the version.
`413`	Artifact too large.
`500`	Server error. Report it.