# BerryBox CI

> GitHub Actions on disposable AMD runners. Public self-service, prepaid credit, actual runtime billing.

Start with /docs/getting-started.md. Agent instructions: /docs/agents.md. Copyable setup prompt: /agent-setup.txt. CLI downloads: /downloads/latest.json. Full reference: /llms-full.txt.

# Documentation

- Getting started
  - [Your first BerryBox build](/docs/getting-started): Connect GitHub, add credit and change one runner label.
  - [Signing in](/docs/getting-started/authentication): Your account, team access and GitHub connection.
  - [Supported workloads](/docs/getting-started/availability): Check compatibility before changing your runner labels.
- CI runners
  - [Choose a runner](/docs/ci-runners): AMD x64 machines for your existing GitHub Actions jobs.
  - [Migrate a workflow](/docs/ci-runners/migration): Preview a small change before you send jobs to BerryBox.
  - [Caches and artifacts](/docs/ci-runners/caching): Persist the files you need through GitHub Actions.
  - [When a job is waiting or fails](/docs/ci-runners/troubleshooting): Find the cause before retrying a paid workflow.
- Agents & tools
  - [Let your agent get started](/docs/agents): One prompt to inspect your workflows and prepare a safe migration.
  - [The BerryBox CLI](/docs/agents/cli): Download a verified archive and connect your team from the terminal.
  - [MCP for coding agents](/docs/agents/mcp): Run BerryBox tools locally over stdio.
- Teams & billing
  - [Your team](/docs/teams-and-billing): Keep GitHub access, runners and spending in one place.
  - [Connect GitHub](/docs/teams-and-billing/github): Authorize your organization and choose which repositories BerryBox can run.
  - [Billing and spending limits](/docs/teams-and-billing/billing): Add credit first. Pay for the runtime your jobs use.
  - [API keys and agent access](/docs/teams-and-billing/management-keys): Give each tool only the access it needs, for the time it needs it.
  - [Invite teammates](/docs/teams-and-billing/invitations): Share access through team roles, not shared credentials.
- API reference
  - [API reference](/docs/api-reference): Team-scoped JSON endpoints for CI and account automation.
  - [CI endpoints](/docs/api-reference/ci): Query runs, wait for completion and manage your team’s CI settings.
  - Management API
    - [Core API contract](/docs/api-reference/management): Generated reference for team identity, API keys and recorded finance.
    - Health
      - [Check API health](/docs/api-reference/management/health/getHealth): Returns process liveness. This does not verify runtime or provider readiness.
    - Management keys
      - [Create a management key](/docs/api-reference/management/management-keys/createManagementKey): Requires keys:write. Requested scopes must be a subset of both the caller's
key scopes and current role permissions. Members create their own keys.
Billing-only members cannot manage keys. Store the returned secret securely;
subsequent list operations cannot retrieve it.
      - [List management keys](/docs/api-reference/management/management-keys/listManagementKeys): Requires keys:read. Owners and admins can list active keys in their team.
Members see only their own active keys. Revoked keys and secrets are omitted.
      - [Revoke a management key](/docs/api-reference/management/management-keys/revokeManagementKey): Requires keys:write and permission to manage this key. Revocation
invalidates its secret. A missing, already revoked, or inaccessible key
is not found.
      - [Rotate a management key](/docs/api-reference/management/management-keys/rotateManagementKey): Requires keys:write and permission to manage this key. The existing secret
stops working immediately. The key ID and scopes remain unchanged.
Rotation is forbidden when the target key has scopes beyond the caller's
current permissions.
    - Recorded finance
      - [Read recorded billing accounting](/docs/api-reference/management/recorded-finance/getRecordedBilling): Requires explicit billing:read and the key creator’s current owner, admin or billing role. Team and account come only from the stored key binding. The exact key generation/scope and membership are checked again in one read-only repeatable snapshot. No caller-supplied team override is supported. Read work has an 8-second transport deadline after the independent key/rate guards. Missing or current-day usage remains unavailable; producer completeness is unverified. No provider IDs, raw usage attributes or private ledger metadata are returned.
      - [Read recorded limits and runtime availability](/docs/api-reference/management/recorded-finance/getRecordedLimits): Requires explicit billing:read and the key creator’s current owner, admin or billing role. Team and account come only from the stored key binding. The exact key generation/scope and membership are checked again in one read-only repeatable snapshot. No caller-supplied team override is supported. Read work has an 8-second transport deadline after the independent key/rate guards. Missing or current-day usage remains unavailable; producer completeness is unverified. No provider IDs, raw usage attributes or private ledger metadata are returned.
      - [Read verified daily usage snapshots](/docs/api-reference/management/recorded-finance/getRecordedUsage): Requires explicit billing:read and the key creator’s current owner, admin or billing role. Team and account come only from the stored key binding. The exact key generation/scope and membership are checked again in one read-only repeatable snapshot. No caller-supplied team override is supported. Read work has an 8-second transport deadline after the independent key/rate guards. Missing or current-day usage remains unavailable; producer completeness is unverified. No provider IDs, raw usage attributes or private ledger metadata are returned.
      - [List curated accounting activity](/docs/api-reference/management/recorded-finance/listRecordedBillingActivity): Requires explicit billing:read and the key creator’s current owner, admin or billing role. Team and account come only from the stored key binding. The exact key generation/scope and membership are checked again in one read-only repeatable snapshot. No caller-supplied team override is supported. Read work has an 8-second transport deadline after the independent key/rate guards. Missing or current-day usage remains unavailable; producer completeness is unverified. No provider IDs, raw usage attributes or private ledger metadata are returned.
    - Teams
      - [Read the current team](/docs/api-reference/management/teams/getCurrentTeam): Requires teams:read. The team is resolved from the key's stored team
binding and the creator's current membership; there is no team override.