Sample - GitHub REST API
PATCH/orgs/{org}/private-registries/{secret_name}

Update a private registry for an organization

Updates a private registry configuration with an encrypted value for an organization. Encrypt your secret using LibSodium. For more information, see "Encrypting secrets for the REST API." For OIDC-based registries (oidc_azure, oidc_aws, oidc_jfrog, oidc_cloudsmith, or oidc_gcp), the encrypted_value and key_id fields should be omitted.

OAuth app tokens and personal access tokens (classic) need the admin:org scope to use this endpoint.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

2 parameters · 24 body fields
orgstringrequired
The organization name. The name is not case sensitive.
secret_namestringrequired
The name of the secret.
registry_typestringoptional
The registry type.
Allowed:maven_repositorynuget_feedgoproxy_servernpm_registryrubygems_servercargo_registrycomposer_repositorydocker_registrygit_sourcehelm_registryhex_organizationhex_repository
urlstringoptional
The URL of the private registry.
usernamestringoptional
The username to use when authenticating with the private registry. This field should be omitted if the private registry does not require a username for authentication.
replaces_basebooleanoptional
Whether this private registry should replace the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When set to `true`, Dependabot will only use this registry and will not fall back to the public registry. When set to `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.
Default:false
encrypted_valuestringoptional
The value for your secret, encrypted with [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages) using the public key retrieved from the [Get private registries public key for an organization](https://docs.github.com/rest/private-registries/organization-configurations#get-private-registries-public-key-for-an-organization) endpoint.
key_idstringoptional
The ID of the key you used to encrypt the secret.
visibilitystringoptional
Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry.
Allowed:allprivateselected
selected_repository_idsarray<integer>optional
An array of repository IDs that can access the organization private registry. You can only provide a list of repository IDs when `visibility` is set to `selected`. This field should be omitted if `visibility` is set to `all` or `private`.
auth_typestringoptional
The authentication type for the private registry. This field cannot be changed after creation. If provided, it must match the existing `auth_type` of the configuration. To change the authentication type, delete and recreate the configuration.
Allowed:tokenusername_passwordoidc_azureoidc_awsoidc_jfrogoidc_cloudsmithoidc_gcp
tenant_idstringoptional
The tenant ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
client_idstringoptional
The client ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
aws_regionstringoptional
The AWS region. Required when `auth_type` is `oidc_aws`.
account_idstringoptional
The AWS account ID. Required when `auth_type` is `oidc_aws`.
role_namestringoptional
The AWS IAM role name. Required when `auth_type` is `oidc_aws`.
domainstringoptional
The CodeArtifact domain. Required when `auth_type` is `oidc_aws`.
domain_ownerstringoptional
The CodeArtifact domain owner (AWS account ID). Required when `auth_type` is `oidc_aws`.
jfrog_oidc_provider_namestringoptional
The JFrog OIDC provider name. Required when `auth_type` is `oidc_jfrog`.
audiencestringoptional
The OIDC audience. Optional for `oidc_aws`, `oidc_jfrog`, and `oidc_gcp`, and required for `oidc_cloudsmith` auth types.
identity_mapping_namestringoptional
The JFrog identity mapping name. Optional for `oidc_jfrog` auth type.
namespacestringoptional
The Cloudsmith organization namespace. Required when `auth_type` is `oidc_cloudsmith`.
service_slugstringoptional
The Cloudsmith service account slug. Required when `auth_type` is `oidc_cloudsmith`.
api_hoststringoptional
The Cloudsmith API host. Optional for `oidc_cloudsmith` auth type. If omitted, `api.cloudsmith.io` is used by default.
workload_identity_providerstringoptional
The full resource name of the GCP Workload Identity Provider (e.g. `projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>`). Required when `auth_type` is `oidc_gcp`.
service_accountstringoptional
The GCP service account email to impersonate. Optional for `oidc_gcp` auth type. If omitted, the federated token is used directly (direct WIF).

3 status codes
204Response
404Resource not found
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
422Validation failed, or the endpoint has been spammed.
messagestringrequired
documentation_urlstringrequired
errorsarray<object>optional

Error handling

A 404 is returned: Resource not found. A 422 is returned: Validation failed, or the endpoint has been spammed.