---
title: "Create a private registry for an organization"
method: POST
path: "/orgs/{org}/private-registries"
tags: ["private-registries"]
---

# Create a private registry for an organization

`POST /orgs/{org}/private-registries`

Creates a private registry configuration with an encrypted value for an organization. Encrypt your secret using [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages). For more information, see "[Encrypting secrets for the REST API](https://docs.github.com/enterprise-cloud@latest//rest/guides/encrypting-secrets-for-the-rest-api)."

OAuth app tokens and personal access tokens (classic) need the `admin:org` scope to use this endpoint.

## Path parameters

- `org` string, required

## Request body

- object
  - `registry_type` 'maven_repository' | 'nuget_feed' | 'goproxy_server' | 'npm_registry' | 'rubygems_server' | 'cargo_registry' | 'composer_repository' | 'docker_registry' | 'git_source' | 'helm_registry' | 'hex_organization' | 'hex_repository' | 'pub_repository' | 'python_index' | 'terraform_registry', required — The registry type.
  - `url` string, uri, required — The URL of the private registry.
  - `username` string, nullable — The username to use when authenticating with the private registry. This field should be omitted if the private registry does not require a username for authentication.
  - `replaces_base` boolean — Whether this private registry should replace the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When set to `true`, Dependabot will only use this registry and will not fall back to the public registry. When set to `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.
  - `encrypted_value` string, required — The value for your secret, encrypted with [LibSodium](https://libsodium.gitbook.io/doc/bindings_for_other_languages) using the public key retrieved from the [Get private registries public key for an organization](https://docs.github.com/enterprise-cloud@latest//rest/private-registries/organization-configurations#get-private-registries-public-key-for-an-organization) endpoint.
  - `key_id` string, required — The ID of the key you used to encrypt the secret.
  - `visibility` 'all' | 'private' | 'selected', required — Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry.
  - `selected_repository_ids` integer[] — An array of repository IDs that can access the organization private registry. You can only provide a list of repository IDs when `visibility` is set to `selected`. You can manage the list of selected repositories using the [Update a private registry for an organization](https://docs.github.com/enterprise-cloud@latest//rest/private-registries/organization-configurations#update-a-private-registry-for-an-organization) endpoint. This field should be omitted if `visibility` is set to `all` or `private`.

## Response `201`

The organization private registry configuration

- OrgPrivateRegistryConfigurationWithSelectedRepositories — Private registry configuration for an organization
  - `name` string, required — The name of the private registry configuration.
  - `registry_type` 'maven_repository' | 'nuget_feed' | 'goproxy_server' | 'npm_registry' | 'rubygems_server' | 'cargo_registry' | 'composer_repository' | 'docker_registry' | 'git_source' | 'helm_registry' | 'hex_organization' | 'hex_repository' | 'pub_repository' | 'python_index' | 'terraform_registry', required — The registry type.
  - `url` string, uri — The URL of the private registry.
  - `username` string — The username to use when authenticating with the private registry.
  - `replaces_base` boolean — Whether this private registry replaces the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When `true`, Dependabot will only use this registry and will not fall back to the public registry. When `false` (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.
  - `visibility` 'all' | 'private' | 'selected', required — Which type of organization repositories have access to the private registry. `selected` means only the repositories specified by `selected_repository_ids` can access the private registry.
  - `selected_repository_ids` integer[] — An array of repository IDs that can access the organization private registry when `visibility` is set to `selected`.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `404` — Resource not found
- `422` — Validation failed, or the endpoint has been spammed.

---

[API](https://skmtc.dev/github/apis/enterprise-cloud.md) · [All operations](https://skmtc.dev/github/apis/enterprise-cloud/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/github/enterprise-cloud/revisions/e26e2e7af931/schema)