API REST et tokens d'acces

Types de tokens

• Personal Access Token (PAT) — Lie a un utilisateur, scopes configurables
• Project Access Token — Lie a un projet, cree un utilisateur bot
• Group Access Token — Lie a un groupe
• CI/CD Job Token — $CI_JOB_TOKEN, genere automatiquement par job
• Deploy Token — Acces en lecture au registry et au depot

Utilisation de l'API REST

# Lister les projets
curl --header "PRIVATE-TOKEN: glpat-xxxxxxxxxxxx" \
  "https://gitlab.example.com/api/v4/projects?membership=true"

# Creer une merge request
curl --request POST \
  --header "PRIVATE-TOKEN: glpat-xxxxxxxxxxxx" \
  --header "Content-Type: application/json" \
  --data '{
    "source_branch": "feature/new-login",
    "target_branch": "main",
    "title": "Add new login page",
    "assignee_id": 42
  }' \
  "https://gitlab.example.com/api/v4/projects/123/merge_requests"

# Declencher un pipeline
curl --request POST \
  --header "PRIVATE-TOKEN: glpat-xxxxxxxxxxxx" \
  --form "ref=main" \
  --form "variables[DEPLOY_ENV]=production" \
  "https://gitlab.example.com/api/v4/projects/123/pipeline"

# Lister les vulnerabilites
curl --header "PRIVATE-TOKEN: glpat-xxxxxxxxxxxx" \
  "https://gitlab.example.com/api/v4/projects/123/vulnerability_findings"

Pagination

# L'API retourne des headers de pagination
# X-Total, X-Total-Pages, X-Per-Page, X-Page
curl -s -D - --header "PRIVATE-TOKEN: $TOKEN" \
  "https://gitlab.example.com/api/v4/projects?per_page=100&page=2"

Script Python d'automatisation

import requests

GITLAB_URL = "https://gitlab.example.com"
TOKEN = "glpat-xxxxxxxxxxxx"
HEADERS = {"PRIVATE-TOKEN": TOKEN}

# Lister tous les projets d'un groupe
def list_group_projects(group_id):
    projects = []
    page = 1
    while True:
        resp = requests.get(
            f"{GITLAB_URL}/api/v4/groups/{group_id}/projects",
            headers=HEADERS,
            params={"per_page": 100, "page": page}
        )
        data = resp.json()
        if not data:
            break
        projects.extend(data)
        page += 1
    return projects

# Proteger la branche main sur tous les projets
def protect_main_branches(group_id):
    for project in list_group_projects(group_id):
        requests.post(
            f"{GITLAB_URL}/api/v4/projects/{project['id']}/protected_branches",
            headers=HEADERS,
            json={
                "name": "main",
                "push_access_level": 0,
                "merge_access_level": 30
            }
        )
        print(f"Protected main on {project['name']}")