Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/santiagonieto09/portafolio/llms.txt

Use this file to discover all available pages before exploring further.

POST /api/public/sync is a protected server-side endpoint that invalidates the snapshot cache and immediately re-fetches all portfolio data from the GitHub API. It is designed to be called by a weekly cron job.

​
Authentication

The endpoint accepts two equivalent authentication methods — either is sufficient:
MethodHeader
Preferred (cron jobs)x-cron-secret: <secret>
AlternativeAuthorization: Bearer <secret>
Both are compared against the CRON_SECRET environment variable. The comparison is performed with a timing-safe byte-by-byte XOR check (safeEqual) to prevent timing attacks — the loop always runs to completion regardless of where a mismatch occurs.
If CRON_SECRET is not set in the environment, the endpoint immediately returns 503 Service Unavailable with {"ok": false, "error": "unavailable"}. Always configure CRON_SECRET before deploying to production.

​
Rate Limiting

A built-in cooldown prevents the endpoint from being called more than once every 10 minutes. The in-process lastForcedSyncAt timestamp is checked on every request. If the minimum interval has not elapsed, the endpoint returns 429 Too Many Requests with {"ok": false, "error": "too_soon"} without touching the cache.

​
Request

curl -X POST https://your-domain.com/api/public/sync \
  -H "x-cron-secret: your-cron-secret" \
  -H "Content-Type: application/json"

​
Response Codes

​
200 OK

Sync completed successfully. The cache was invalidated and a fresh snapshot was fetched from GitHub. 
{
  "ok": true,
  "syncedAt": "2024-01-15T06:00:00.000Z",
  "repositories": 12,
  "releases": 5
}
​
ok
boolean
Always true on a successful sync.
​
syncedAt
string
ISO 8601 timestamp of when the new snapshot was written to cache. Sourced from snapshot.stats.lastSyncedAt.
​
repositories
number
Total number of non-forked repositories included in the synced snapshot.
​
releases
number
Number of repositories that have at least one published GitHub release.

​
401 Unauthorized

The x-cron-secret or Authorization: Bearer value does not match CRON_SECRET, or no credential was provided. 
{ "ok": false, "error": "unauthorized" }

​
429 Too Many Requests

The endpoint was called before the 10-minute cooldown elapsed since the last successful sync. 
{ "ok": false, "error": "too_soon" }

​
503 Service Unavailable

The CRON_SECRET environment variable is not configured. 
{ "ok": false, "error": "unavailable" }

​
GitHub Actions Cron Example

The recommended way to trigger a weekly sync is a GitHub Actions workflow scheduled with cron. This lets you use repository secrets for both the portfolio URL and the shared secret.
.github/workflows/sync.yml
name: Weekly portfolio sync
on:
  schedule:
    - cron: '0 6 * * 1'
jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger sync
        run: |
          curl -s -X POST ${{ secrets.PORTFOLIO_URL }}/api/public/sync \
            -H "x-cron-secret: ${{ secrets.CRON_SECRET }}" \
            -w "\nHTTP %{http_code}"
The schedule above fires every Monday at 06:00 UTC.
Vercel Cron Jobs cannot send custom headers and therefore cannot authenticate this endpoint. Use GitHub Actions, a custom cron service, or any HTTP client that supports custom request headers.

Build docs developers (and LLMs) love

Get started for freeTalk to us