Create a private registry for an organization

POST

/orgs/{org}/private-registries

Creates a private registry configuration with an encrypted value for an organization. Encrypt your secret using LibSodium. For more information, see “Encrypting secrets for the REST API.” For OIDC-based registries (oidc_azure, oidc_aws, oidc_jfrog, oidc_cloudsmith, or oidc_gcp), the encrypted_value and key_id fields should be omitted.

OAuth app tokens and personal access tokens (classic) need the admin:org scope to use this endpoint.

API method documentation

Parameters

Path Parameters

org

required

string

The organization name. The name is not case sensitive.

Request Body^required

application/json

object

registry_type

required

The registry type.

string

Allowed values: maven_repository nuget_feed goproxy_server npm_registry rubygems_server cargo_registry composer_repository docker_registry git_source helm_registry hex_organization hex_repository pub_repository python_index terraform_registry

url

required

The URL of the private registry.

string format: uri

username

The username to use when authenticating with the private registry. This field should be omitted if the private registry does not require a username for authentication.

string

nullable

replaces_base

Whether this private registry should replace the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When set to true, Dependabot will only use this registry and will not fall back to the public registry. When set to false (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.

boolean

encrypted_value

The value for your secret, encrypted with LibSodium using the public key retrieved from the Get private registries public key for an organization endpoint. Required when auth_type is token or username_password. Should be omitted for OIDC auth types.

string

/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/

key_id

The ID of the key you used to encrypt the secret. Required when auth_type is token or username_password. Should be omitted for OIDC auth types.

string

visibility

required

Which type of organization repositories have access to the private registry. selected means only the repositories specified by selected_repository_ids can access the private registry.

string

Allowed values: all private selected

selected_repository_ids

An array of repository IDs that can access the organization private registry. You can only provide a list of repository IDs when visibility is set to selected. You can manage the list of selected repositories using the Update a private registry for an organization endpoint. This field should be omitted if visibility is set to all or private.

Array<integer>

auth_type

The authentication type for the private registry. Defaults to token if not specified. Use oidc_azure, oidc_aws, oidc_jfrog, oidc_cloudsmith, or oidc_gcp for OIDC authentication.

string

Allowed values: token username_password oidc_azure oidc_aws oidc_jfrog oidc_cloudsmith oidc_gcp

tenant_id

The tenant ID of the Azure AD application. Required when auth_type is oidc_azure.

string

client_id

The client ID of the Azure AD application. Required when auth_type is oidc_azure.

string

aws_region

The AWS region. Required when auth_type is oidc_aws.

string

account_id

The AWS account ID. Required when auth_type is oidc_aws.

string

role_name

The AWS IAM role name. Required when auth_type is oidc_aws.

string

domain

The CodeArtifact domain. Required when auth_type is oidc_aws.

string

domain_owner

The CodeArtifact domain owner (AWS account ID). Required when auth_type is oidc_aws.

string

jfrog_oidc_provider_name

The JFrog OIDC provider name. Required when auth_type is oidc_jfrog.

string

audience

The OIDC audience. Optional for oidc_aws, oidc_jfrog, and oidc_gcp, and required for oidc_cloudsmith auth types.

string

identity_mapping_name

The JFrog identity mapping name. Optional for oidc_jfrog auth type.

string

namespace

The Cloudsmith organization namespace. Required when auth_type is oidc_cloudsmith.

string

service_slug

The Cloudsmith service account slug. Required when auth_type is oidc_cloudsmith.

string

api_host

The Cloudsmith API host. Optional for oidc_cloudsmith auth type. If omitted, api.cloudsmith.io is used by default.

string

workload_identity_provider

The full resource name of the GCP Workload Identity Provider (e.g. projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>). Required when auth_type is oidc_gcp.

string

service_account

The GCP service account email to impersonate. Optional for oidc_gcp auth type. If omitted, the federated token is used directly (direct WIF).

string

Examples

Example of a private registry configuration with private visibility

{
  "registry_type": "maven_repository",
  "url": "https://maven.pkg.github.com/organization/",
  "username": "monalisa",
  "replaces_base": true,
  "encrypted_value": "c2VjcmV0",
  "key_id": "012345678912345678",
  "visibility": "private"
}

Example of a private registry configuration with selected visibility

{
  "registry_type": "maven_repository",
  "url": "https://maven.pkg.github.com/organization/",
  "username": "monalisa",
  "encrypted_value": "c2VjcmV0",
  "key_id": "012345678912345678",
  "visibility": "selected",
  "selected_repository_ids": [
    1296269,
    1296280
  ]
}

Example of an OIDC private registry configuration using Azure

{
  "registry_type": "docker_registry",
  "url": "https://myregistry.azurecr.io",
  "auth_type": "oidc_azure",
  "visibility": "all",
  "tenant_id": "12345678-1234-1234-1234-123456789012",
  "client_id": "abcdef01-2345-6789-abcd-ef0123456789"
}

Example of an OIDC private registry configuration using Cloudsmith

{
  "registry_type": "npm_registry",
  "url": "https://npm.cloudsmith.io/my-org/my-repo/",
  "auth_type": "oidc_cloudsmith",
  "visibility": "all",
  "namespace": "my-org",
  "service_slug": "my-service-account",
  "audience": "https://github.com/my-org"
}

Example of an OIDC private registry configuration using Google Cloud Artifact Registry

{
  "registry_type": "docker_registry",
  "url": "https://us-docker.pkg.dev/my-project/my-repo",
  "auth_type": "oidc_gcp",
  "visibility": "all",
  "workload_identity_provider": "projects/123456789/locations/global/workloadIdentityPools/github-pool/providers/github-provider",
  "service_account": "dependabot@my-project.iam.gserviceaccount.com"
}

Responses

201

The organization private registry configuration

application/json

Organization private registry

Private registry configuration for an organization

object

name

required

The name of the private registry configuration.

string

registry_type

required

The registry type.

string

auth_type

The authentication type for the private registry.

string

Allowed values: token username_password oidc_azure oidc_aws oidc_jfrog oidc_cloudsmith oidc_gcp

url

The URL of the private registry.

string format: uri

username

The username to use when authenticating with the private registry.

string

replaces_base

Whether this private registry replaces the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When true, Dependabot will only use this registry and will not fall back to the public registry. When false (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.

boolean

visibility

required

Which type of organization repositories have access to the private registry. selected means only the repositories specified by selected_repository_ids can access the private registry.

string

Allowed values: all private selected

selected_repository_ids

An array of repository IDs that can access the organization private registry when visibility is set to selected.

Array<integer>

tenant_id

The tenant ID of the Azure AD application.

string

client_id

The client ID of the Azure AD application.

string

aws_region

The AWS region.

string

account_id

The AWS account ID.

string

role_name

The AWS IAM role name.

string

domain

The CodeArtifact domain.

string

domain_owner

The CodeArtifact domain owner.

string

jfrog_oidc_provider_name

The JFrog OIDC provider name.

string

audience

The OIDC audience.

string

identity_mapping_name

The JFrog identity mapping name.

string

namespace

The Cloudsmith organization namespace.

string

service_slug

The Cloudsmith service account slug.

string

api_host

The Cloudsmith API host.

string

workload_identity_provider

The full resource name of the GCP Workload Identity Provider (e.g. projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>).

string

service_account

The GCP service account email to impersonate. If omitted, the federated token is used directly (direct WIF).

string

created_at

required

string format: date-time

updated_at

required

string format: date-time

Examples

{
  "name": "MAVEN_REPOSITORY_SECRET",
  "registry_type": "maven_repository",
  "username": "monalisa",
  "visibility": "private",
  "created_at": "2019-08-10T14:59:22Z",
  "updated_at": "2020-01-10T14:59:22Z"
}

{
  "name": "MAVEN_REPOSITORY_SECRET",
  "registry_type": "maven_repository",
  "username": "monalisa",
  "visibility": "selected",
  "selected_repository_ids": [
    1296269,
    1296280
  ],
  "created_at": "2019-08-10T14:59:22Z",
  "updated_at": "2020-01-10T14:59:22Z"
}

404

Resource not found

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

422

Validation failed, or the endpoint has been spammed.

application/json

Validation Error

Validation Error

object

message

required

string

documentation_url

required

string

errors

Array<object>

object

resource

string

field

string

message

string

code

required

string

index

integer

value

One of:

string

nullable

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "errors": [
    {
      "resource": "example",
      "field": "example",
      "message": "example",
      "code": "example",
      "index": 1,
      "value": [
        "example"
      ]
    }
  ]
}

Create a private registry for an organization

Parameters

Path Parameters

Request Body required

Examples

Responses

201

Examples

404

Example generated

422

Example generated

Request Body^required

Example ^generated

Example ^generated