> For the complete documentation index, see [llms.txt](https://vampauth.gitbook.io/vampauth-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vampauth.gitbook.io/vampauth-docs/api-reference/management/loaders.md).

# Loaders and publishing

| Method and path                     | Scope               | Result                                          |
| ----------------------------------- | ------------------- | ----------------------------------------------- |
| GET /loaders                        | loaders:read        | Paginated account loaders; optional project\_id |
| GET /projects/{project\_id}/loaders | loaders:read        | Paginated linked loaders                        |
| POST /loaders                       | loaders:write       | Publish; 201, Location, loader ETag             |
| GET /loaders/{loader\_id}           | loaders:read        | Detail and loader ETag                          |
| PATCH /loaders/{loader\_id}         | loaders:write       | Metadata/move, loader If-Match                  |
| DELETE /loaders/{loader\_id}        | loaders:delete      | Delete, loader If-Match                         |
| GET /loaders/{loader\_id}/content   | loaders:source:read | Protected payload as text/plain                 |
| PUT /loaders/{loader\_id}/content   | loaders:write       | Replace original input, loader If-Match         |
| POST /loaders/{loader\_id}/rotate   | loaders:write       | Rotate URL, loader If-Match                     |

Access requires script ownership or manage\_loaders on the linked project. Detached loaders require their script owner and an unrestricted token. A move checks both projects and preserves script ownership.

## Publish

POST uses multipart/form-data, not JSON/base64. Required project\_id, alias, source, and exactly one input: source=upload with file (.lua/.txt), or source=paste with content. Optional display\_name.

Alias: `^[a-z0-9][a-z0-9_-]{0,49}$`. Display name: trimmed, at most 80 Unicode code points, no controls/line separators; blank clears. It is independent of the technical alias.

Supply a UUID Idempotency-Key. Original UTF-8 input is capped at 8 MiB; total body at 8 MiB + 16 KiB; non-source overhead at 16 KiB. Duplicate/unknown fields fail. The publishing provider's own size/capability rules and owner's effective publishing allowance also apply.

Only protected immutable outputs are stored. The input source cannot be recovered through GET content. Genuine upstream publishing acceptance isn't implied by a successful transport test.

## Edit metadata

PATCH accepts alias, project\_id, display\_name, with at least one field. Null/blank display\_name clears it; omission preserves it. Display-only renames don't consume publishing credit or change payload/URL. Limit: 4 KiB. Optional idempotency key.

## Replace and rotate

PUT content accepts nonblank original UTF-8 text/plain, optional UTF-8 charset, up to 8 MiB. Supply loader If-Match and a UUID Idempotency-Key. A failed publish preserves active content.

Rotate accepts zero actual bytes or {} (limit 1 KiB), loader If-Match, and a UUID Idempotency-Key. It regenerates bootstrap/URL while retaining the exact protected payload pointer/hash/size.

GET content is a heavy read with separate loaders:source:read scope. It returns protected payload only; failures are JSON.

Deletion accepts empty input/{} and optional idempotency key. Retired artifacts follow grace/active-reference protection rather than immediate deletion of bytes still in use.

## Loader response

id, project\_id (nullable), alias, display\_name (nullable), size\_bytes, sdk\_mode, is\_primary, delivery\_url (nullable), created\_at, updated\_at, loader\_rotated\_at. Values such as sdk\_mode can describe legacy rows; they aren't a request to initialize the retired manual SDK.

## Next steps

* [Loader](/vampauth-docs/development/loader.md)
* [Retries, revisions, and limits](/vampauth-docs/api-reference/management/retries-and-limits.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://vampauth.gitbook.io/vampauth-docs/api-reference/management/loaders.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.