Bridge Worker

BridgeWorker represents a bridge worker in ConfigHub. A bridge worker is a worker program that connects ConfigHub to external systems and targets. It acts as a bridge between ConfigHub and the infrastructure where configurations need to be applied. Bridge workers are responsible for executing configuration changes on remote targets and reporting status back to ConfigHub. When starting a bridge worker program, both the BridgeWorkerID and Secret are required for authentication with the ConfigHub server. These credentials allow the bridge worker to establish a secure connection and receive configuration actions.

Operations

Method	Endpoint	Description
GET	/bridge_worker	List of BridgeWorkers across spaces
GET	/space/{space_id}/bridge_worker	List BridgeWorkers
GET	/space/{space_id}/bridge_worker/{bridge_worker_id}/function	List available functions supported by a specific bridge worker
GET	/space/{space_id}/bridge_worker/{bridge_worker_id}	Get BridgeWorker
POST	/bridge_worker/{bridge_worker_id}/user_action_result	Create action result
POST	/space/{space_id}/bridge_worker	Create BridgeWorker
PATCH	/bridge_worker	Bulk patch multiple bridge workers
PATCH	/space/{space_id}/bridge_worker/{bridge_worker_id}	Patch BridgeWorker
PUT	/space/{space_id}/bridge_worker/{bridge_worker_id}	Update BridgeWorker
DELETE	/bridge_worker	Bulk delete multiple bridge workers
DELETE	/space/{space_id}/bridge_worker/{bridge_worker_id}	Delete BridgeWorker

---

List of BridgeWorkers across spaces

GET /bridge_worker

Retrieves a list of BridgeWorkers across spaces in the Organization

Operation ID: ListAllBridgeWorkers

Parameters

Query Parameters

Parameter	Type	Required	Description
where	string		The specified string is an expression for the purpose of filtering the list of BridgeWorkers returned. The expression syntax was inspired by SQL. It supports conjunctions using AND of relational expressions of the form attribute operator attribute_or_literal. The attribute names are case-sensitive and PascalCase, as in the JSON encoding. Strings support the following operators: <, >, <=, >=, =, !=, LIKE, NOT LIKE, ILIKE, ~~, !~~, ~, ~*, !~, !~*, IN, NOT IN. String pattern operators: LIKE and ~~ for pattern matching with % and _ wildcards, ILIKE for case-insensitive pattern matching, NOT LIKE and !~~ for negated pattern matching. String regex operators: ~ for regex matching, ~* for case-insensitive regex, !~ and !~* for regex not matching (case-sensitive and insensitive). Integers support the following operators: <, >, <=, >=, =, !=, IN, NOT IN. UUIDs and boolean attributes support equality and inequality only. UUID and time literals must be quoted as string literals. String literals are quoted with single quotes, such as 'string'. Time literals use the same form as when serialized as JSON, such as: CreatedAt > '2025-02-18T23:16:34'. Integer and boolean literals are also supported for attributes of those types. Arrays support the ? operator to to match any element of the array, as in FromLinkID ? '7c61626f-ddbe-41af-93f6-b69f4ab6d308'. Arrays can perform LEN() to check for length, as in LEN(FromLinkID) > 0. An attribute naming a list of other entities can be filtered on their attributes with a * segment, as in FromLink.*.Slug = 'upgrade-app', which holds when any element satisfies it. Without the * such a reference is an error, since it names no single value to compare. Map support the dot notation to specify a particular map key, as in Labels.tier = 'Backend'. Maps support IS NULL and IS NOT NULL with dot notation to check for key absence or presence, as in Labels.tier IS NULL (key doesn't exist) or Labels.tier IS NOT NULL (key exists). Comparison results can be tested with IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE. These are useful for nullable columns: MergeSourceID = '<uuid>' IS NOT FALSE matches rows where MergeSourceID equals the value OR is NULL. The IN and NOT IN operators accept a comma-separated list of values in parentheses, such as Slug IN ('slugone', 'slugtwo') or Labels.environment IN ('prod', 'staging'). Conjunctions are supported using the AND operator. An example conjunction is: CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'. Supported attributes for filtering on BridgeWorker: Annotations, BridgeWorkerID, Condition, CreatedAt, DisplayName, HiddenReason, IPAddress, Labels, LastMessage, LastSeenAt, OrgRole, OrganizationID, Permissions, ProvidedInfo, Slug, SpaceID, UpdatedAt, UserID. The whole string must be query-encoded.
filter	string		UUID of a Filter entity to apply to the BridgeWorker list. The Filter must be in the same Organization as the user credentials. The Filter's From field must match the entity type being filtered (BridgeWorker). For Space-resident entities, if the Filter has a FromSpaceID, it must match the operation's SpaceID. The Filter's Where clause will be combined with any explicit 'where' parameter using AND logic. If both 'filter' and 'where' parameters are specified, they are combined with AND logic.
contains	string		Free text search that approximately matches the specified string against string fields and map keys/values. The search is case-insensitive and uses pattern matching to find entities containing the text. Searchable string fields include attributes like Slug, DisplayName, and string-typed custom fields. For map fields (like Labels and Annotations), the search matches both map keys and values. The search uses OR logic across all searchable fields, so matching any field will return the entity. If both 'where' and 'contains' parameters are specified, they are combined with AND logic. Searchable fields for BridgeWorker include string and map-type attributes from the queryable attributes list. The whole string must be query-encoded.
include	string		Include clause for expanding related entities in the response for BridgeWorker. The attribute names are case-sensitive, PascalCase, and expected in a comma-separated list format as in the JSON encoding. Supported attributes for BridgeWorker are OrganizationID, SpaceID. The whole string must be query-encoded.
select	string		Select clause for specifying which fields to include in the response for BridgeWorker. The attribute names are case-sensitive, PascalCase, and expected in a comma-separated list format as in the JSON encoding. If not specified, all fields are returned. Entity and parent IDs (like OrganizationID, SpaceID, BridgeWorkerID) and Slug are always returned regardless of the select parameter. Fields used in where and contains filters, fields named by order_by, and fields read by the columns of the View named by view are also automatically included. Example: 'DisplayName,CreatedAt,Labels' will return only those fields plus the required ID and Slug fields. The whole string must be query-encoded.
include_hidden	string		Hidden BridgeWorker entities, those with a HiddenReason, are left out of the results, or of what a bulk operation acts on, unless this names their HiddenReason. It is a comma-separated list of HiddenReasons, or * for all of them. A where clause naming the entities, by their Slug or ID with = or IN, or naming HiddenReason at all, also returns hidden entities it selects. ConfigHub/YAML Units, which hold the configuration of entities, are hidden with the HiddenReason BackingUnit.
view	string		UUID of a View whose columns to compute for each BridgeWorker, returned as ViewColumns. The View must be in the same Organization as the user credentials, and be a View of BridgeWorker: its Of, or the From of its Filter, must be BridgeWorker. If the View has a Filter, the Filter selects the entities as the filter parameter does, so the two may not both be specified. The related entities and fields the View's columns read are included and selected automatically, so neither include nor select has to name them.
limit	integer		Maximum number of BridgeWorker entities to return. If not specified, all matching entities are returned. Values greater than 1000 are rejected with 400. When there may be more entities, the response has a ConfigHub-Continue header to pass as the continue parameter of the next request.
order_by	string		Comma-separated list of fields to sort BridgeWorker results by, each in the form 'ASC|DESC:FieldName' or just 'FieldName'. Field names are case-sensitive and PascalCase, as in the JSON encoding. Sort direction defaults to ASC when the 'DIRECTION:' prefix is omitted. Supported attributes for ordering BridgeWorker: BridgeWorkerID, Condition, CreatedAt, DisplayName, HiddenReason, IPAddress, LastMessage, LastSeenAt, OrgRole, OrganizationID, Slug, SpaceID, UpdatedAt, UserID. Example: 'DESC:CreatedAt' or 'DisplayName,DESC:CreatedAt'. Results are ordered by the BridgeWorker's ID after the fields named, and by the ID alone if none are. The whole string must be query-encoded.
continue	string		The token from the ConfigHub-Continue header of the previous page, to return the BridgeWorker entities after it. The request's other parameters, except limit, must be the same as those of the request that returned the token. Keep reading until a response has no such header: a page can hold fewer entities than the limit, or none, and still be followed by more.
summary	boolean		Include summary information in the response

Responses

Status	Description	Content-Type	Schema
200	OK	application/json	Array of ExtendedBridgeWorker
400	BridgeWorker request is invalid (Bad Request).	application/json	StandardErrorResponse
401	Unauthorized access.	application/json	StandardErrorResponse
403	Forbidden access.	application/json	StandardErrorResponse
404	BridgeWorker not found.	application/json	StandardErrorResponse
500	Something went wrong while processing BridgeWorker.	application/json	StandardErrorResponse
default	Unexpected error.	application/json	StandardErrorResponse

---

List BridgeWorkers

GET /space/{space_id}/bridge_worker

List BridgeWorkers

Operation ID: ListBridgeWorkers

Parameters

Path Parameters

Parameter	Type	Required	Description
space_id	string	✓	Unique identifier for a space_id

Query Parameters

Parameter	Type	Required	Description
where	string		The specified string is an expression for the purpose of filtering the list of BridgeWorkers returned. The expression syntax was inspired by SQL. It supports conjunctions using AND of relational expressions of the form attribute operator attribute_or_literal. The attribute names are case-sensitive and PascalCase, as in the JSON encoding. Strings support the following operators: <, >, <=, >=, =, !=, LIKE, NOT LIKE, ILIKE, ~~, !~~, ~, ~*, !~, !~*, IN, NOT IN. String pattern operators: LIKE and ~~ for pattern matching with % and _ wildcards, ILIKE for case-insensitive pattern matching, NOT LIKE and !~~ for negated pattern matching. String regex operators: ~ for regex matching, ~* for case-insensitive regex, !~ and !~* for regex not matching (case-sensitive and insensitive). Integers support the following operators: <, >, <=, >=, =, !=, IN, NOT IN. UUIDs and boolean attributes support equality and inequality only. UUID and time literals must be quoted as string literals. String literals are quoted with single quotes, such as 'string'. Time literals use the same form as when serialized as JSON, such as: CreatedAt > '2025-02-18T23:16:34'. Integer and boolean literals are also supported for attributes of those types. Arrays support the ? operator to to match any element of the array, as in FromLinkID ? '7c61626f-ddbe-41af-93f6-b69f4ab6d308'. Arrays can perform LEN() to check for length, as in LEN(FromLinkID) > 0. An attribute naming a list of other entities can be filtered on their attributes with a * segment, as in FromLink.*.Slug = 'upgrade-app', which holds when any element satisfies it. Without the * such a reference is an error, since it names no single value to compare. Map support the dot notation to specify a particular map key, as in Labels.tier = 'Backend'. Maps support IS NULL and IS NOT NULL with dot notation to check for key absence or presence, as in Labels.tier IS NULL (key doesn't exist) or Labels.tier IS NOT NULL (key exists). Comparison results can be tested with IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE. These are useful for nullable columns: MergeSourceID = '<uuid>' IS NOT FALSE matches rows where MergeSourceID equals the value OR is NULL. The IN and NOT IN operators accept a comma-separated list of values in parentheses, such as Slug IN ('slugone', 'slugtwo') or Labels.environment IN ('prod', 'staging'). Conjunctions are supported using the AND operator. An example conjunction is: CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'. Supported attributes for filtering on BridgeWorker: Annotations, BridgeWorkerID, Condition, CreatedAt, DisplayName, HiddenReason, IPAddress, Labels, LastMessage, LastSeenAt, OrgRole, OrganizationID, Permissions, ProvidedInfo, Slug, SpaceID, UpdatedAt, UserID. The whole string must be query-encoded.
filter	string		UUID of a Filter entity to apply to the BridgeWorker list. The Filter must be in the same Organization as the user credentials. The Filter's From field must match the entity type being filtered (BridgeWorker). For Space-resident entities, if the Filter has a FromSpaceID, it must match the operation's SpaceID. The Filter's Where clause will be combined with any explicit 'where' parameter using AND logic. If both 'filter' and 'where' parameters are specified, they are combined with AND logic.
contains	string		Free text search that approximately matches the specified string against string fields and map keys/values. The search is case-insensitive and uses pattern matching to find entities containing the text. Searchable string fields include attributes like Slug, DisplayName, and string-typed custom fields. For map fields (like Labels and Annotations), the search matches both map keys and values. The search uses OR logic across all searchable fields, so matching any field will return the entity. If both 'where' and 'contains' parameters are specified, they are combined with AND logic. Searchable fields for BridgeWorker include string and map-type attributes from the queryable attributes list. The whole string must be query-encoded.
include	string		Include clause for expanding related entities in the response for BridgeWorker. The attribute names are case-sensitive, PascalCase, and expected in a comma-separated list format as in the JSON encoding. Supported attributes for BridgeWorker are OrganizationID, SpaceID. The whole string must be query-encoded.
select	string		Select clause for specifying which fields to include in the response for BridgeWorker. The attribute names are case-sensitive, PascalCase, and expected in a comma-separated list format as in the JSON encoding. If not specified, all fields are returned. Entity and parent IDs (like OrganizationID, SpaceID, BridgeWorkerID) and Slug are always returned regardless of the select parameter. Fields used in where and contains filters, fields named by order_by, and fields read by the columns of the View named by view are also automatically included. Example: 'DisplayName,CreatedAt,Labels' will return only those fields plus the required ID and Slug fields. The whole string must be query-encoded.
include_hidden	string		Hidden BridgeWorker entities, those with a HiddenReason, are left out of the results, or of what a bulk operation acts on, unless this names their HiddenReason. It is a comma-separated list of HiddenReasons, or * for all of them. A where clause naming the entities, by their Slug or ID with = or IN, or naming HiddenReason at all, also returns hidden entities it selects. ConfigHub/YAML Units, which hold the configuration of entities, are hidden with the HiddenReason BackingUnit.
view	string		UUID of a View whose columns to compute for each BridgeWorker, returned as ViewColumns. The View must be in the same Organization as the user credentials, and be a View of BridgeWorker: its Of, or the From of its Filter, must be BridgeWorker. If the View has a Filter, the Filter selects the entities as the filter parameter does, so the two may not both be specified. The related entities and fields the View's columns read are included and selected automatically, so neither include nor select has to name them.
limit	integer		Maximum number of BridgeWorker entities to return. If not specified, all matching entities are returned. Values greater than 1000 are rejected with 400. When there may be more entities, the response has a ConfigHub-Continue header to pass as the continue parameter of the next request.
order_by	string		Comma-separated list of fields to sort BridgeWorker results by, each in the form 'ASC|DESC:FieldName' or just 'FieldName'. Field names are case-sensitive and PascalCase, as in the JSON encoding. Sort direction defaults to ASC when the 'DIRECTION:' prefix is omitted. Supported attributes for ordering BridgeWorker: BridgeWorkerID, Condition, CreatedAt, DisplayName, HiddenReason, IPAddress, LastMessage, LastSeenAt, OrgRole, OrganizationID, Slug, SpaceID, UpdatedAt, UserID. Example: 'DESC:CreatedAt' or 'DisplayName,DESC:CreatedAt'. Results are ordered by the BridgeWorker's ID after the fields named, and by the ID alone if none are. The whole string must be query-encoded.
continue	string		The token from the ConfigHub-Continue header of the previous page, to return the BridgeWorker entities after it. The request's other parameters, except limit, must be the same as those of the request that returned the token. Keep reading until a response has no such header: a page can hold fewer entities than the limit, or none, and still be followed by more.

Responses

Status	Description	Content-Type	Schema
200	OK	application/json	Array of ExtendedBridgeWorker
400	BridgeWorker request is invalid (Bad Request).	application/json	StandardErrorResponse
401	Unauthorized access.	application/json	StandardErrorResponse
403	Forbidden access.	application/json	StandardErrorResponse
404	BridgeWorker not found.	application/json	StandardErrorResponse
500	Something went wrong while processing BridgeWorker.	application/json	StandardErrorResponse
default	Unexpected error.	application/json	StandardErrorResponse

---

List available functions supported by a specific bridge worker

GET /space/{space_id}/bridge_worker/{bridge_worker_id}/function

List available functions supported by a specific bridge worker

Operation ID: ListBridgeWorkerFunctions

Parameters

Path Parameters

Parameter	Type	Required	Description
space_id	string	✓	Unique identifier for a space_id
bridge_worker_id	string	✓	Unique identifier for a bridge_worker_id

Responses

Status	Description	Content-Type	Schema
200	OK	application/json	object

---

Get BridgeWorker

GET /space/{space_id}/bridge_worker/{bridge_worker_id}

Get BridgeWorker

Operation ID: GetBridgeWorker

Parameters

Path Parameters

Parameter	Type	Required	Description
space_id	string	✓	Unique identifier for a space_id
bridge_worker_id	string	✓	Unique identifier for a bridge_worker_id

Query Parameters

Parameter	Type	Required	Description
include	string		Include clause for expanding related entities in the response for BridgeWorker. The attribute names are case-sensitive, PascalCase, and expected in a comma-separated list format as in the JSON encoding. Supported attributes for BridgeWorker are OrganizationID, SpaceID. The whole string must be query-encoded.
select	string		Select clause for specifying which fields to include in the response for BridgeWorker. The attribute names are case-sensitive, PascalCase, and expected in a comma-separated list format as in the JSON encoding. If not specified, all fields are returned. Entity and parent IDs (like OrganizationID, SpaceID, BridgeWorkerID) and Slug are always returned regardless of the select parameter. Fields used in where and contains filters, fields named by order_by, and fields read by the columns of the View named by view are also automatically included. Example: 'DisplayName,CreatedAt,Labels' will return only those fields plus the required ID and Slug fields. The whole string must be query-encoded.

Responses

Status	Description	Content-Type	Schema
200	OK	application/json	ExtendedBridgeWorker
400	BridgeWorker request is invalid (Bad Request).	application/json	StandardErrorResponse
401	Unauthorized access.	application/json	StandardErrorResponse
403	Forbidden access.	application/json	StandardErrorResponse
404	BridgeWorker not found.	application/json	StandardErrorResponse
500	Something went wrong while processing BridgeWorker.	application/json	StandardErrorResponse
default	Unexpected error.	application/json	StandardErrorResponse

---

Create action result

POST /bridge_worker/{bridge_worker_id}/user_action_result

Records the status/result of an action executed by a bridge worker using a worker user identity

Operation ID: UserCreateActionResult

Parameters

Path Parameters

Parameter	Type	Required	Description
bridge_worker_id	string	✓	Unique identifier for a bridge_worker_id

Request Body

Content-Type: application/json

Schema: ActionResult

Responses

Status	Description	Content-Type	Schema
200	OK	application/json	string
400	BridgeWorker request is invalid (Bad Request).	application/json	StandardErrorResponse
401	Unauthorized access.	application/json	StandardErrorResponse
403	Forbidden access.	application/json	StandardErrorResponse
404	BridgeWorker not found.	application/json	StandardErrorResponse
409	BridgeWorker data conflict. Data has changed since last read.	application/json	StandardErrorResponse
500	Something went wrong while processing BridgeWorker.	application/json	StandardErrorResponse
default	Unexpected error.	application/json	StandardErrorResponse

---

Create BridgeWorker

POST /space/{space_id}/bridge_worker

Create BridgeWorker

Operation ID: CreateBridgeWorker

Parameters

Path Parameters

Parameter	Type	Required	Description
space_id	string	✓	Unique identifier for a space_id

Query Parameters

Parameter	Type	Required	Description
allow_exists	string		Allowed values are true and false. Default is false. When true, reports success when an entity already exists and returns the existing entity
dry_run	boolean		If true, report what the write would do without doing it: the write runs, including every check it makes, and is then rolled back. The response is the one the write would return, with the entities as they would be written. An entity a dry run creates is given an ID that the real create will not reuse.

Request Body

Content-Type: application/json

Schema: BridgeWorker

Responses

Status	Description	Content-Type	Schema
200	BridgeWorker represents a bridge worker in ConfigHub. A bridge worker is a worker program that connects ConfigHub to external systems and targets. It acts as a bridge between ConfigHub and the infrastructure where configurations need to be applied. Bridge workers are responsible for executing configuration changes on remote targets and reporting status back to ConfigHub. When starting a bridge worker program, both the BridgeWorkerID and Secret are required for authentication with the ConfigHub server. These credentials allow the bridge worker to establish a secure connection and receive configuration actions.	application/json	BridgeWorker
400	BridgeWorker request is invalid (Bad Request).	application/json	StandardErrorResponse
401	Unauthorized access.	application/json	StandardErrorResponse
403	Forbidden access.	application/json	StandardErrorResponse
404	BridgeWorker not found.	application/json	StandardErrorResponse
409	BridgeWorker data conflict. Data has changed since last read.	application/json	StandardErrorResponse
500	Something went wrong while processing BridgeWorker.	application/json	StandardErrorResponse
default	Unexpected error.	application/json	StandardErrorResponse

---

Bulk patch multiple bridge workers

PATCH /bridge_worker

Apply JSON merge patch to multiple bridge workers selected by query parameters

Operation ID: BulkPatchBridgeWorkers

Parameters

Query Parameters

Parameter	Type	Required	Description
where	string		The specified string is an expression for the purpose of filtering the list of BridgeWorkers returned. The expression syntax was inspired by SQL. It supports conjunctions using AND of relational expressions of the form attribute operator attribute_or_literal. The attribute names are case-sensitive and PascalCase, as in the JSON encoding. Strings support the following operators: <, >, <=, >=, =, !=, LIKE, NOT LIKE, ILIKE, ~~, !~~, ~, ~*, !~, !~*, IN, NOT IN. String pattern operators: LIKE and ~~ for pattern matching with % and _ wildcards, ILIKE for case-insensitive pattern matching, NOT LIKE and !~~ for negated pattern matching. String regex operators: ~ for regex matching, ~* for case-insensitive regex, !~ and !~* for regex not matching (case-sensitive and insensitive). Integers support the following operators: <, >, <=, >=, =, !=, IN, NOT IN. UUIDs and boolean attributes support equality and inequality only. UUID and time literals must be quoted as string literals. String literals are quoted with single quotes, such as 'string'. Time literals use the same form as when serialized as JSON, such as: CreatedAt > '2025-02-18T23:16:34'. Integer and boolean literals are also supported for attributes of those types. Arrays support the ? operator to to match any element of the array, as in FromLinkID ? '7c61626f-ddbe-41af-93f6-b69f4ab6d308'. Arrays can perform LEN() to check for length, as in LEN(FromLinkID) > 0. An attribute naming a list of other entities can be filtered on their attributes with a * segment, as in FromLink.*.Slug = 'upgrade-app', which holds when any element satisfies it. Without the * such a reference is an error, since it names no single value to compare. Map support the dot notation to specify a particular map key, as in Labels.tier = 'Backend'. Maps support IS NULL and IS NOT NULL with dot notation to check for key absence or presence, as in Labels.tier IS NULL (key doesn't exist) or Labels.tier IS NOT NULL (key exists). Comparison results can be tested with IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE. These are useful for nullable columns: MergeSourceID = '<uuid>' IS NOT FALSE matches rows where MergeSourceID equals the value OR is NULL. The IN and NOT IN operators accept a comma-separated list of values in parentheses, such as Slug IN ('slugone', 'slugtwo') or Labels.environment IN ('prod', 'staging'). Conjunctions are supported using the AND operator. An example conjunction is: CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'. Supported attributes for filtering on BridgeWorker: Annotations, BridgeWorkerID, Condition, CreatedAt, DisplayName, HiddenReason, IPAddress, Labels, LastMessage, LastSeenAt, OrgRole, OrganizationID, Permissions, ProvidedInfo, Slug, SpaceID, UpdatedAt, UserID. The whole string must be query-encoded.
filter	string		UUID of a Filter entity to apply to the BridgeWorker list. The Filter must be in the same Organization as the user credentials. The Filter's From field must match the entity type being filtered (BridgeWorker). For Space-resident entities, if the Filter has a FromSpaceID, it must match the operation's SpaceID. The Filter's Where clause will be combined with any explicit 'where' parameter using AND logic. If both 'filter' and 'where' parameters are specified, they are combined with AND logic.
contains	string		Free text search that approximately matches the specified string against string fields and map keys/values. The search is case-insensitive and uses pattern matching to find entities containing the text. Searchable string fields include attributes like Slug, DisplayName, and string-typed custom fields. For map fields (like Labels and Annotations), the search matches both map keys and values. The search uses OR logic across all searchable fields, so matching any field will return the entity. If both 'where' and 'contains' parameters are specified, they are combined with AND logic. Searchable fields for BridgeWorker include string and map-type attributes from the queryable attributes list. The whole string must be query-encoded.
include_hidden	string		Hidden BridgeWorker entities, those with a HiddenReason, are left out of the results, or of what a bulk operation acts on, unless this names their HiddenReason. It is a comma-separated list of HiddenReasons, or * for all of them. A where clause naming the entities, by their Slug or ID with = or IN, or naming HiddenReason at all, also returns hidden entities it selects. ConfigHub/YAML Units, which hold the configuration of entities, are hidden with the HiddenReason BackingUnit.
include	string		Include clause for expanding related entities in the response for BridgeWorker. The attribute names are case-sensitive, PascalCase, and expected in a comma-separated list format as in the JSON encoding. Supported attributes for BridgeWorker are OrganizationID, SpaceID. The whole string must be query-encoded.
limit	integer		Maximum number of BridgeWorker entities to act on, in ID order. A request that names limit or continue also stops when it runs short of time, and returns a ConfigHub-Continue header to pass as the continue parameter of the next request; keep sending requests until a response has none. If neither is specified, the request acts on every selected entity.
continue	string		The token from the ConfigHub-Continue header of the previous request, to act on the BridgeWorker entities after the last one it acted on. The request's other parameters, except limit, must be the same as those of the request that returned the token.
dry_run	boolean		If true, report what the write would do without doing it: the write runs, including every check it makes, and is then rolled back. The response is the one the write would return, with the entities as they would be written. An entity a dry run creates is given an ID that the real create will not reuse.

Request Body

Content-Type: application/merge-patch+json

Responses

Status	Description	Content-Type	Schema
200	OK	application/json	Array of BridgeWorkerCreateOrUpdateResponse
207	Multi-Status: Mixed success and failure results	application/json	Array of BridgeWorkerCreateOrUpdateResponse
400	BridgeWorker request is invalid (Bad Request).	application/json	StandardErrorResponse
401	Unauthorized access.	application/json	StandardErrorResponse
403	Forbidden access.	application/json	StandardErrorResponse
404	BridgeWorker not found.	application/json	StandardErrorResponse
409	BridgeWorker data conflict. Data has changed since last read.	application/json	StandardErrorResponse
500	Something went wrong while processing BridgeWorker.	application/json	StandardErrorResponse
default	Unexpected error.	application/json	StandardErrorResponse

---

Patch BridgeWorker

PATCH /space/{space_id}/bridge_worker/{bridge_worker_id}

Patch BridgeWorker

Operation ID: PatchBridgeWorker

Parameters

Path Parameters

Parameter	Type	Required	Description
space_id	string	✓	Unique identifier for a space_id
bridge_worker_id	string	✓	Unique identifier for a bridge_worker_id

Query Parameters

Parameter	Type	Required	Description
dry_run	boolean		If true, report what the write would do without doing it: the write runs, including every check it makes, and is then rolled back. The response is the one the write would return, with the entities as they would be written. An entity a dry run creates is given an ID that the real create will not reuse.

Request Body

Content-Type: application/merge-patch+json

Responses

Status	Description	Content-Type	Schema
200	BridgeWorker represents a bridge worker in ConfigHub. A bridge worker is a worker program that connects ConfigHub to external systems and targets. It acts as a bridge between ConfigHub and the infrastructure where configurations need to be applied. Bridge workers are responsible for executing configuration changes on remote targets and reporting status back to ConfigHub. When starting a bridge worker program, both the BridgeWorkerID and Secret are required for authentication with the ConfigHub server. These credentials allow the bridge worker to establish a secure connection and receive configuration actions.	application/json	BridgeWorker
400	BridgeWorker request is invalid (Bad Request).	application/json	StandardErrorResponse
401	Unauthorized access.	application/json	StandardErrorResponse
403	Forbidden access.	application/json	StandardErrorResponse
404	BridgeWorker not found.	application/json	StandardErrorResponse
409	BridgeWorker data conflict. Data has changed since last read.	application/json	StandardErrorResponse
500	Something went wrong while processing BridgeWorker.	application/json	StandardErrorResponse
default	Unexpected error.	application/json	StandardErrorResponse

---

Update BridgeWorker

PUT /space/{space_id}/bridge_worker/{bridge_worker_id}

Update BridgeWorker

Operation ID: UpdateBridgeWorker

Parameters

Path Parameters

Parameter	Type	Required	Description
space_id	string	✓	Unique identifier for a space_id
bridge_worker_id	string	✓	Unique identifier for a bridge_worker_id

Query Parameters

Parameter	Type	Required	Description
dry_run	boolean		If true, report what the write would do without doing it: the write runs, including every check it makes, and is then rolled back. The response is the one the write would return, with the entities as they would be written. An entity a dry run creates is given an ID that the real create will not reuse.

Request Body

Content-Type: application/json

Schema: BridgeWorker

Responses

Status	Description	Content-Type	Schema
200	BridgeWorker represents a bridge worker in ConfigHub. A bridge worker is a worker program that connects ConfigHub to external systems and targets. It acts as a bridge between ConfigHub and the infrastructure where configurations need to be applied. Bridge workers are responsible for executing configuration changes on remote targets and reporting status back to ConfigHub. When starting a bridge worker program, both the BridgeWorkerID and Secret are required for authentication with the ConfigHub server. These credentials allow the bridge worker to establish a secure connection and receive configuration actions.	application/json	BridgeWorker
400	BridgeWorker request is invalid (Bad Request).	application/json	StandardErrorResponse
401	Unauthorized access.	application/json	StandardErrorResponse
403	Forbidden access.	application/json	StandardErrorResponse
404	BridgeWorker not found.	application/json	StandardErrorResponse
409	BridgeWorker data conflict. Data has changed since last read.	application/json	StandardErrorResponse
500	Something went wrong while processing BridgeWorker.	application/json	StandardErrorResponse
default	Unexpected error.	application/json	StandardErrorResponse

---

Bulk delete multiple bridge workers

DELETE /bridge_worker

Delete multiple bridge workers selected by query parameters

Operation ID: BulkDeleteBridgeWorkers

Parameters

Query Parameters

Parameter	Type	Required	Description
where	string		The specified string is an expression for the purpose of filtering the list of BridgeWorkers returned. The expression syntax was inspired by SQL. It supports conjunctions using AND of relational expressions of the form attribute operator attribute_or_literal. The attribute names are case-sensitive and PascalCase, as in the JSON encoding. Strings support the following operators: <, >, <=, >=, =, !=, LIKE, NOT LIKE, ILIKE, ~~, !~~, ~, ~*, !~, !~*, IN, NOT IN. String pattern operators: LIKE and ~~ for pattern matching with % and _ wildcards, ILIKE for case-insensitive pattern matching, NOT LIKE and !~~ for negated pattern matching. String regex operators: ~ for regex matching, ~* for case-insensitive regex, !~ and !~* for regex not matching (case-sensitive and insensitive). Integers support the following operators: <, >, <=, >=, =, !=, IN, NOT IN. UUIDs and boolean attributes support equality and inequality only. UUID and time literals must be quoted as string literals. String literals are quoted with single quotes, such as 'string'. Time literals use the same form as when serialized as JSON, such as: CreatedAt > '2025-02-18T23:16:34'. Integer and boolean literals are also supported for attributes of those types. Arrays support the ? operator to to match any element of the array, as in FromLinkID ? '7c61626f-ddbe-41af-93f6-b69f4ab6d308'. Arrays can perform LEN() to check for length, as in LEN(FromLinkID) > 0. An attribute naming a list of other entities can be filtered on their attributes with a * segment, as in FromLink.*.Slug = 'upgrade-app', which holds when any element satisfies it. Without the * such a reference is an error, since it names no single value to compare. Map support the dot notation to specify a particular map key, as in Labels.tier = 'Backend'. Maps support IS NULL and IS NOT NULL with dot notation to check for key absence or presence, as in Labels.tier IS NULL (key doesn't exist) or Labels.tier IS NOT NULL (key exists). Comparison results can be tested with IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE. These are useful for nullable columns: MergeSourceID = '<uuid>' IS NOT FALSE matches rows where MergeSourceID equals the value OR is NULL. The IN and NOT IN operators accept a comma-separated list of values in parentheses, such as Slug IN ('slugone', 'slugtwo') or Labels.environment IN ('prod', 'staging'). Conjunctions are supported using the AND operator. An example conjunction is: CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'. Supported attributes for filtering on BridgeWorker: Annotations, BridgeWorkerID, Condition, CreatedAt, DisplayName, HiddenReason, IPAddress, Labels, LastMessage, LastSeenAt, OrgRole, OrganizationID, Permissions, ProvidedInfo, Slug, SpaceID, UpdatedAt, UserID. The whole string must be query-encoded.
filter	string		UUID of a Filter entity to apply to the BridgeWorker list. The Filter must be in the same Organization as the user credentials. The Filter's From field must match the entity type being filtered (BridgeWorker). For Space-resident entities, if the Filter has a FromSpaceID, it must match the operation's SpaceID. The Filter's Where clause will be combined with any explicit 'where' parameter using AND logic. If both 'filter' and 'where' parameters are specified, they are combined with AND logic.
contains	string		Free text search that approximately matches the specified string against string fields and map keys/values. The search is case-insensitive and uses pattern matching to find entities containing the text. Searchable string fields include attributes like Slug, DisplayName, and string-typed custom fields. For map fields (like Labels and Annotations), the search matches both map keys and values. The search uses OR logic across all searchable fields, so matching any field will return the entity. If both 'where' and 'contains' parameters are specified, they are combined with AND logic. Searchable fields for BridgeWorker include string and map-type attributes from the queryable attributes list. The whole string must be query-encoded.
include_hidden	string		Hidden BridgeWorker entities, those with a HiddenReason, are left out of the results, or of what a bulk operation acts on, unless this names their HiddenReason. It is a comma-separated list of HiddenReasons, or * for all of them. A where clause naming the entities, by their Slug or ID with = or IN, or naming HiddenReason at all, also returns hidden entities it selects. ConfigHub/YAML Units, which hold the configuration of entities, are hidden with the HiddenReason BackingUnit.
include	string		Include clause for expanding related entities in the response for BridgeWorker. The attribute names are case-sensitive, PascalCase, and expected in a comma-separated list format as in the JSON encoding. Supported attributes for BridgeWorker are OrganizationID, SpaceID. The whole string must be query-encoded.
limit	integer		Maximum number of BridgeWorker entities to act on, in ID order. A request that names limit or continue also stops when it runs short of time, and returns a ConfigHub-Continue header to pass as the continue parameter of the next request; keep sending requests until a response has none. If neither is specified, the request acts on every selected entity.
continue	string		The token from the ConfigHub-Continue header of the previous request, to act on the BridgeWorker entities after the last one it acted on. The request's other parameters, except limit, must be the same as those of the request that returned the token.
detach	boolean		If true, remove the references to the deleted entities from entities the request does not delete, instead of refusing the delete while any remain. References that cannot be removed still refuse it. For a Space, applies to everything the recursive delete removes.

Responses

Status	Description	Content-Type	Schema
200	OK	application/json	Array of DeleteResponse
207	Multi-Status: Mixed success and failure results	application/json	Array of DeleteResponse
400	BridgeWorker request is invalid (Bad Request).	application/json	StandardErrorResponse
401	Unauthorized access.	application/json	StandardErrorResponse
403	Forbidden access.	application/json	StandardErrorResponse
404	BridgeWorker not found.	application/json	StandardErrorResponse
409	BridgeWorker is still in use: it has DeleteGates, or other entities still reference it. Or data has changed since last read.	application/json	StandardErrorResponse
422	Unable to delete entity	application/json	StandardErrorResponse
500	Something went wrong while processing BridgeWorker.	application/json	StandardErrorResponse
default	Unexpected error.	application/json	StandardErrorResponse

---

Delete BridgeWorker

DELETE /space/{space_id}/bridge_worker/{bridge_worker_id}

Delete BridgeWorker

Operation ID: DeleteBridgeWorker

Parameters

Path Parameters

Parameter	Type	Required	Description
space_id	string	✓	Unique identifier for a space_id
bridge_worker_id	string	✓	Unique identifier for a bridge_worker_id

Query Parameters

Parameter	Type	Required	Description
detach	boolean		If true, remove the references to the deleted entities from entities the request does not delete, instead of refusing the delete while any remain. References that cannot be removed still refuse it. For a Space, applies to everything the recursive delete removes.

Responses

Status	Description	Content-Type	Schema
200	Response for successful delete operation	application/json	DeleteResponse
400	BridgeWorker request is invalid (Bad Request).	application/json	StandardErrorResponse
401	Unauthorized access.	application/json	StandardErrorResponse
403	Forbidden access.	application/json	StandardErrorResponse
404	BridgeWorker not found.	application/json	StandardErrorResponse
409	BridgeWorker is still in use: it has DeleteGates, or other entities still reference it. Or data has changed since last read.	application/json	StandardErrorResponse
422	BridgeWorker could not be deleted.	application/json	StandardErrorResponse
500	Something went wrong while processing BridgeWorker.	application/json	StandardErrorResponse
default	Unexpected error.	application/json	StandardErrorResponse

---

Schemas

ActionResult

Properties

Property	Type	Required	Description
Action	ActionType
Data	string (base64)		Updated configuration Data of the Unit (for refresh and import)
ErrorMessages	Array of string		Warning or error messages to surface to the user
Message	string
QueuedOperationID	string (uuid)		UUID of the operation corresponding to the action request
Result	ActionResultType
RevisionNum	integer (int64)
SpaceID	string (uuid)		UUID of the Space of the Unit on which the action is performed
StartedAt	string (date-time)
Status	ActionStatusType
TerminatedAt	string (date-time)
UnitID	string (uuid)		UUID of the Unit on which the action is performed

BridgeWorker

BridgeWorker represents a bridge worker in ConfigHub. A bridge worker is a worker program that connects ConfigHub to external systems and targets. It acts as a bridge between ConfigHub and the infrastructure where configurations need to be applied. Bridge workers are responsible for executing configuration changes on remote targets and reporting status back to ConfigHub. When starting a bridge worker program, both the BridgeWorkerID and Secret are required for authentication with the ConfigHub server. These credentials allow the bridge worker to establish a secure connection and receive configuration actions.

Properties

Property	Type	Required	Description
Annotations	object		An optional map of Annotation key/value pairs for tools to attach information to entities.
BridgeWorkerID	string (uuid)		Unique identifier for a Bridge Worker.
ClaimTTLSeconds	integer
ClaimToken	string (uuid)
Condition	string		Condition represents the worker's readiness state (Ready, NotReady, Unresponsive, Disconnected).
CreatedAt	string (date-time)		The timestamp when the entity was created in "2023-01-01T12:00:00Z" format.
DeleteGates	object		An optional set of gates that, if any is present, will block deletion.
DisplayName	string		Friendly name for the entity.
EntityType	string		The type of entity.
HiddenReason	string		The reason the entity is hidden, if it is. A hidden entity is left out of List and Search results, and of what bulk operations act on, unless the include_hidden parameter names its reason or is *, or the where parameter names the entity by Slug or ID. ConfigHub/YAML Units are created hidden with the reason BackingUnit unless given another.
IPAddress	string		IPAddress is the IP address from which the worker last connected.
Labels	object		An optional map of Label key/value pairs to specify identifying attributes of entities for the purpose of grouping and filtering them.
LastMessage	string		LastMessage contains the last message from the worker (heartbeat message or other status).
LastSeenAt	string (date-time)		LastSeenAt is the time the worker was last seen (heartbeat, connection, or any event).
OrgRole	string		Organization-level role of the BridgeWorker User. Defaults to none, which leaves the User with only the permissions granted to it.
OrganizationID	string (uuid)		Unique identifier for an organization.
Permissions			Permissions to access this bridge worker.
ProvidedInfo			ProvidedInfo contains information about the bridge worker in JSON format. It is sent by the bridge worker program to the ConfigHub server when it first connects. It can also be set before the bridge worker connects, but it is not recommended to change it while a worker is connected. This can include details about the capabilities, and targets supported by the bridge worker.
Secret	string		Secret is a unique secret token for the bridge worker. It's auto-generated when the BridgeWorker entity is created and cannot be modified. This field is output-only and used for authentication. This secret is required when starting the bridge worker program.
Slug	string	✓	Unique URL-safe identifier for the entity.
SpaceID	string (uuid)		Unique identifier for a space.
SpaceSlug	string		Slug of the Space this entity belongs to. (readonly)
UpdatedAt	string (date-time)		The timestamp when the entity was last updated in "2023-01-01T12:00:00Z" format.
UserID	string (uuid)		UserID is the ID of the bot user associated with this bridge worker. This user is created when the bridge worker is created and is used for audit trails and permissions. For legacy workers, this field may be nil (zero UUID).
Version	integer (int64)		An entity-specific sequence number used for optimistic concurrency control. The value read must be sent in calls to Update.

BridgeWorkerCreateOrUpdateResponse

Properties

Property	Type	Required	Description
BridgeWorker	BridgeWorker
Error	ResponseError

DeleteResponse

Response for successful delete operation

Properties

Property	Type	Required	Description
Error			Error information if the delete operation failed.
Message	string		Response message.

ExtendedBridgeWorker

Properties

Property	Type	Required	Description
BridgeWorker	BridgeWorker
Error	ResponseError
Organization	Organization
Space	Space
ViewColumns	Array of ViewColumn		The values of the columns of the View named by the view parameter, in the View's column order. A column that selects several values, such as one with a wildcard, has an entry for each, all with the column's Name.

StandardErrorResponse

The body of an error response: the error as data (Error), and as one string (message) for clients written before Error.

Properties

Property	Type	Required	Description
Error			The error: its message, category (Type), HTTP status, details, and structured items.
message	string		The error as one string: its message, with any details, items, and individual errors appended. Kept for clients written before Error; new clients read Error.