Skip to content
forgit api docs

Update a private registry for an organization

PATCH
/orgs/{org}/private-registries/{secret_name}

Updates a private registry configuration with an encrypted value for an organization. Encrypt your secret using LibSodium. For more information, see “Encrypting secrets for the REST API.” For OIDC-based registries (oidc_azure, oidc_aws, oidc_jfrog, oidc_cloudsmith, or oidc_gcp), the encrypted_value and key_id fields should be omitted.

OAuth app tokens and personal access tokens (classic) need the admin:org scope to use this endpoint.

API method documentation

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “ Path Parameters ”
org
required
string

The organization name. The name is not case sensitive.

secret_name
required
string

The name of the secret.

Request Body required

Section titled “ Request Body required ”
Media type application/json
object
registry_type

The registry type.

string
Allowed values: maven_repository nuget_feed goproxy_server npm_registry rubygems_server cargo_registry composer_repository docker_registry git_source helm_registry hex_organization hex_repository pub_repository python_index terraform_registry
url

The URL of the private registry.

string format: uri
username

The username to use when authenticating with the private registry. This field should be omitted if the private registry does not require a username for authentication.

string
nullable
replaces_base

Whether this private registry should replace the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When set to true, Dependabot will only use this registry and will not fall back to the public registry. When set to false (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.

boolean
encrypted_value

The value for your secret, encrypted with LibSodium using the public key retrieved from the Get private registries public key for an organization endpoint.

string
/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/
key_id

The ID of the key you used to encrypt the secret.

string
visibility

Which type of organization repositories have access to the private registry. selected means only the repositories specified by selected_repository_ids can access the private registry.

string
Allowed values: all private selected
selected_repository_ids

An array of repository IDs that can access the organization private registry. You can only provide a list of repository IDs when visibility is set to selected. This field should be omitted if visibility is set to all or private.

Array<integer>
auth_type

The authentication type for the private registry. This field cannot be changed after creation. If provided, it must match the existing auth_type of the configuration. To change the authentication type, delete and recreate the configuration.

string
Allowed values: token username_password oidc_azure oidc_aws oidc_jfrog oidc_cloudsmith oidc_gcp
tenant_id

The tenant ID of the Azure AD application. Required when auth_type is oidc_azure.

string
client_id

The client ID of the Azure AD application. Required when auth_type is oidc_azure.

string
aws_region

The AWS region. Required when auth_type is oidc_aws.

string
account_id

The AWS account ID. Required when auth_type is oidc_aws.

string
role_name

The AWS IAM role name. Required when auth_type is oidc_aws.

string
domain

The CodeArtifact domain. Required when auth_type is oidc_aws.

string
domain_owner

The CodeArtifact domain owner (AWS account ID). Required when auth_type is oidc_aws.

string
jfrog_oidc_provider_name

The JFrog OIDC provider name. Required when auth_type is oidc_jfrog.

string
audience

The OIDC audience. Optional for oidc_aws, oidc_jfrog, and oidc_gcp, and required for oidc_cloudsmith auth types.

string
identity_mapping_name

The JFrog identity mapping name. Optional for oidc_jfrog auth type.

string
namespace

The Cloudsmith organization namespace. Required when auth_type is oidc_cloudsmith.

string
service_slug

The Cloudsmith service account slug. Required when auth_type is oidc_cloudsmith.

string
api_host

The Cloudsmith API host. Optional for oidc_cloudsmith auth type. If omitted, api.cloudsmith.io is used by default.

string
workload_identity_provider

The full resource name of the GCP Workload Identity Provider (e.g. projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>). Required when auth_type is oidc_gcp.

string
service_account

The GCP service account email to impersonate. Optional for oidc_gcp auth type. If omitted, the federated token is used directly (direct WIF).

string
Examples

Update a secret-based private registry 

{
  "username": "monalisa",
  "encrypted_value": "c2VjcmV0",
  "key_id": "012345678912345678"
}

Responses

Section titled “ Responses ”

204

Section titled “ 204 ”

Response

404

Section titled “ 404 ”

Resource not found

Media type application/json
Basic Error

Basic Error

object
message
string
documentation_url
string
url
string
status
string
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

422

Section titled “ 422 ”

Validation failed, or the endpoint has been spammed.

Media type application/json
Validation Error

Validation Error

object
message
required
string
documentation_url
required
string
errors
Array<object>
object
resource
string
field
string
message
string
code
required
string
index
integer
value
One of:
string
nullable
Example generated 
{
  "message": "example",
  "documentation_url": "example",
  "errors": [
    {
      "resource": "example",
      "field": "example",
      "message": "example",
      "code": "example",
      "index": 1,
      "value": [
        "example"
      ]
    }
  ]
}