Sample - GitHub REST API
POST/orgs/{org}/private-registries

Create a private registry for an organization

Creates a private registry configuration with an encrypted value for an organization. Encrypt your secret using LibSodium. For more information, see "Encrypting secrets for the REST API." For OIDC-based registries (oidc_azure, oidc_aws, oidc_jfrog, oidc_cloudsmith, or oidc_gcp), the encrypted_value and key_id fields should be omitted.

OAuth app tokens and personal access tokens (classic) need the admin:org scope to use this endpoint.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

1 parameter · 24 body fields
orgstringrequired
The organization name. The name is not case sensitive.
registry_typestringrequired
The registry type.
Allowed:maven_repositorynuget_feedgoproxy_servernpm_registryrubygems_servercargo_registrycomposer_repositorydocker_registrygit_sourcehelm_registryhex_organizationhex_repository
urlstringrequired
The URL of the private registry.
usernamestringoptional
The username to use when authenticating with the private registry. This field should be omitted if the private registry does not require a username for authentication.
replaces_basebooleanoptional
Whether this private registry should replace the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When set to `true`, Dependabot will only use this registry and will not fall back to the public registry. When set to `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.
Default:false
encrypted_valuestringoptional
The value for your secret, encrypted with [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages) using the public key retrieved from the [Get private registries public key for an organization](https://docs.github.com/rest/private-registries/organization-configurations#get-private-registries-public-key-for-an-organization) endpoint. Required when `auth_type` is `token` or `username_password`. Should be omitted for OIDC auth types.
key_idstringoptional
The ID of the key you used to encrypt the secret. Required when `auth_type` is `token` or `username_password`. Should be omitted for OIDC auth types.
visibilitystringrequired
Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry.
Allowed:allprivateselected
selected_repository_idsarray<integer>optional
An array of repository IDs that can access the organization private registry. You can only provide a list of repository IDs when `visibility` is set to `selected`. You can manage the list of selected repositories using the [Update a private registry for an organization](https://docs.github.com/rest/private-registries/organization-configurations#update-a-private-registry-for-an-organization) endpoint. This field should be omitted if `visibility` is set to `all` or `private`.
auth_typestringoptional
The authentication type for the private registry. Defaults to `token` if not specified. Use `oidc_azure`, `oidc_aws`, `oidc_jfrog`, `oidc_cloudsmith`, or `oidc_gcp` for OIDC authentication.
Allowed:tokenusername_passwordoidc_azureoidc_awsoidc_jfrogoidc_cloudsmithoidc_gcp
tenant_idstringoptional
The tenant ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
client_idstringoptional
The client ID of the Azure AD application. Required when `auth_type` is `oidc_azure`.
aws_regionstringoptional
The AWS region. Required when `auth_type` is `oidc_aws`.
account_idstringoptional
The AWS account ID. Required when `auth_type` is `oidc_aws`.
role_namestringoptional
The AWS IAM role name. Required when `auth_type` is `oidc_aws`.
domainstringoptional
The CodeArtifact domain. Required when `auth_type` is `oidc_aws`.
domain_ownerstringoptional
The CodeArtifact domain owner (AWS account ID). Required when `auth_type` is `oidc_aws`.
jfrog_oidc_provider_namestringoptional
The JFrog OIDC provider name. Required when `auth_type` is `oidc_jfrog`.
audiencestringoptional
The OIDC audience. Optional for `oidc_aws`, `oidc_jfrog`, and `oidc_gcp`, and required for `oidc_cloudsmith` auth types.
identity_mapping_namestringoptional
The JFrog identity mapping name. Optional for `oidc_jfrog` auth type.
namespacestringoptional
The Cloudsmith organization namespace. Required when `auth_type` is `oidc_cloudsmith`.
service_slugstringoptional
The Cloudsmith service account slug. Required when `auth_type` is `oidc_cloudsmith`.
api_hoststringoptional
The Cloudsmith API host. Optional for `oidc_cloudsmith` auth type. If omitted, `api.cloudsmith.io` is used by default.
workload_identity_providerstringoptional
The full resource name of the GCP Workload Identity Provider (e.g. `projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>`). Required when `auth_type` is `oidc_gcp`.
service_accountstringoptional
The GCP service account email to impersonate. Optional for `oidc_gcp` auth type. If omitted, the federated token is used directly (direct WIF).

3 status codes
201The organization private registry configuration
namestringrequired
The name of the private registry configuration.
registry_typestringrequired
The registry type.
Allowed:maven_repositorynuget_feedgoproxy_servernpm_registryrubygems_servercargo_registrycomposer_repositorydocker_registrygit_sourcehelm_registryhex_organizationhex_repository
auth_typestringoptional
The authentication type for the private registry.
Allowed:tokenusername_passwordoidc_azureoidc_awsoidc_jfrogoidc_cloudsmithoidc_gcp
urlstringoptional
The URL of the private registry.
usernamestringoptional
The username to use when authenticating with the private registry.
replaces_basebooleanoptional
Whether this private registry replaces the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When `true`, Dependabot will only use this registry and will not fall back to the public registry. When `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.
Default:false
visibilitystringrequired
Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry.
Allowed:allprivateselected
selected_repository_idsarray<integer>optional
An array of repository IDs that can access the organization private registry when `visibility` is set to `selected`.
tenant_idstringoptional
The tenant ID of the Azure AD application.
client_idstringoptional
The client ID of the Azure AD application.
aws_regionstringoptional
The AWS region.
account_idstringoptional
The AWS account ID.
role_namestringoptional
The AWS IAM role name.
domainstringoptional
The CodeArtifact domain.
domain_ownerstringoptional
The CodeArtifact domain owner.
jfrog_oidc_provider_namestringoptional
The JFrog OIDC provider name.
audiencestringoptional
The OIDC audience.
identity_mapping_namestringoptional
The JFrog identity mapping name.
namespacestringoptional
The Cloudsmith organization namespace.
service_slugstringoptional
The Cloudsmith service account slug.
api_hoststringoptional
The Cloudsmith API host.
workload_identity_providerstringoptional
The full resource name of the GCP Workload Identity Provider (e.g. `projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>`).
service_accountstringoptional
The GCP service account email to impersonate. If omitted, the federated token is used directly (direct WIF).
created_atstringrequired
updated_atstringrequired
404Resource not found
messagestringoptional
documentation_urlstringoptional
urlstringoptional
statusstringoptional
422Validation failed, or the endpoint has been spammed.
messagestringrequired
documentation_urlstringrequired
errorsarray<object>optional

Error handling

A 404 is returned: Resource not found. A 422 is returned: Validation failed, or the endpoint has been spammed.