private-registries

Create a private registry for an organization

Changed on

Creates a private registry configuration with an encrypted value for an organization. Encrypt your secret using LibSodium. For more information, see "Encrypting secrets for the REST API." For OIDC-based registries (oidc_azure, oidc_aws, oidc_jfrog, oidc_cloudsmith, or oidc_gcp), the encrypted_value and key_id fields should be omitted. For anonymous registries (anonymous), the username, encrypted_value, and key_id fields must be omitted.

OAuth app tokens and personal access tokens (classic) need the admin:org scope to use this endpoint.

post/orgs/{org}/private-registries

Request

  • Base URL: https://api.github.com
  • URL: https://api.github.com/orgs/{org}/private-registries
  • Auth: none declared

Path parameters

orgstring required

The organization name. The name is not case sensitive.

Request body

registry_type'maven_repository' | 'nuget_feed' | 'goproxy_server' | 'npm_registry' | 'rubygems_server' | 'cargo_registry' | 'composer_repository' | 'docker_registry' | 'git_source' | 'helm_registry' | 'hex_organization' | 'hex_repository' | 'pub_repository' | 'python_index' | 'terraform_registry' required

The registry type.

urlstring uri required

The URL of the private registry.

usernamestring nullable

The username to use when authenticating with the private registry. This field should be omitted if the private registry does not require a username for authentication.

replaces_baseboolean

Whether this private registry should replace the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When set to true, Dependabot will only use this registry and will not fall back to the public registry. When set to false (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.

encrypted_valuestring

The value for your secret, encrypted with LibSodium using the public key retrieved from the Get private registries public key for an organization endpoint. Required when auth_type is token or username_password. Should be omitted for OIDC auth types.

key_idstring

The ID of the key you used to encrypt the secret. Required when auth_type is token or username_password. Should be omitted for OIDC auth types.

visibility'all' | 'private' | 'selected' required

Which type of organization repositories have access to the private registry. selected means only the repositories specified by selected_repository_ids can access the private registry.

selected_repository_idsinteger[]

An array of repository IDs that can access the organization private registry. You can only provide a list of repository IDs when visibility is set to selected. You can manage the list of selected repositories using the Update a private registry for an organization endpoint. This field should be omitted if visibility is set to all or private.

auth_type'token' | 'username_password' | 'oidc_azure' | 'oidc_aws' | 'oidc_jfrog' | 'oidc_cloudsmith' | 'oidc_gcp' | 'anonymous'

The authentication type for the private registry. Defaults to token if not specified. Use oidc_azure, oidc_aws, oidc_jfrog, oidc_cloudsmith, or oidc_gcp for OIDC authentication. Use anonymous for registries that do not require authentication; username, encrypted_value, and key_id must be omitted.

tenant_idstring

The tenant ID of the Azure AD application. Required when auth_type is oidc_azure.

client_idstring

The client ID of the Azure AD application. Required when auth_type is oidc_azure.

aws_regionstring

The AWS region. Required when auth_type is oidc_aws.

account_idstring

The AWS account ID. Required when auth_type is oidc_aws.

role_namestring

The AWS IAM role name. Required when auth_type is oidc_aws.

domainstring

The CodeArtifact domain. Required when auth_type is oidc_aws.

domain_ownerstring

The CodeArtifact domain owner (AWS account ID). Required when auth_type is oidc_aws.

jfrog_oidc_provider_namestring

The JFrog OIDC provider name. Required when auth_type is oidc_jfrog.

audiencestring

The OIDC audience. Optional for oidc_aws, oidc_jfrog, and oidc_gcp, and required for oidc_cloudsmith auth types.

identity_mapping_namestring

The JFrog identity mapping name. Optional for oidc_jfrog auth type.

namespacestring

The Cloudsmith organization namespace. Required when auth_type is oidc_cloudsmith.

service_slugstring

The Cloudsmith service account slug. Required when auth_type is oidc_cloudsmith.

api_hoststring

The Cloudsmith API host. Optional for oidc_cloudsmith auth type. If omitted, api.cloudsmith.io is used by default.

workload_identity_providerstring

The full resource name of the GCP Workload Identity Provider (e.g. projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>). Required when auth_type is oidc_gcp.

service_accountstring

The GCP service account email to impersonate. Optional for oidc_gcp auth type. If omitted, the federated token is used directly (direct WIF).

Response

The organization private registry configuration

namestring required

The name of the private registry configuration.

registry_type'maven_repository' | 'nuget_feed' | 'goproxy_server' | 'npm_registry' | 'rubygems_server' | 'cargo_registry' | 'composer_repository' | 'docker_registry' | 'git_source' | 'helm_registry' | 'hex_organization' | 'hex_repository' | 'pub_repository' | 'python_index' | 'terraform_registry' required

The registry type.

auth_type'token' | 'username_password' | 'oidc_azure' | 'oidc_aws' | 'oidc_jfrog' | 'oidc_cloudsmith' | 'oidc_gcp' | 'anonymous'

The authentication type for the private registry.

urlstring uri

The URL of the private registry.

usernamestring

The username to use when authenticating with the private registry.

replaces_baseboolean

Whether this private registry replaces the base registry (e.g., npmjs.org for npm, rubygems.org for rubygems). When true, Dependabot will only use this registry and will not fall back to the public registry. When false (default), Dependabot will use this registry for scoped packages but may fall back to the public registry for other packages.

visibility'all' | 'private' | 'selected' required

Which type of organization repositories have access to the private registry. selected means only the repositories specified by selected_repository_ids can access the private registry.

selected_repository_idsinteger[]

An array of repository IDs that can access the organization private registry when visibility is set to selected.

tenant_idstring

The tenant ID of the Azure AD application.

client_idstring

The client ID of the Azure AD application.

aws_regionstring

The AWS region.

account_idstring

The AWS account ID.

role_namestring

The AWS IAM role name.

domainstring

The CodeArtifact domain.

domain_ownerstring

The CodeArtifact domain owner.

jfrog_oidc_provider_namestring

The JFrog OIDC provider name.

audiencestring

The OIDC audience.

identity_mapping_namestring

The JFrog identity mapping name.

namespacestring

The Cloudsmith organization namespace.

service_slugstring

The Cloudsmith service account slug.

api_hoststring

The Cloudsmith API host.

workload_identity_providerstring

The full resource name of the GCP Workload Identity Provider (e.g. projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>).

service_accountstring

The GCP service account email to impersonate. If omitted, the federated token is used directly (direct WIF).

created_atstring date-time required
updated_atstring date-time required

Example response

{
  "name": "MAVEN_REPOSITORY_SECRET",
  "username": "monalisa"
}

Changes

  • 2026-03-103df3a14aaef4Revision changes
    • warning

      added the new anonymous enum value to the response property for the response status

    • info

      added the new anonymous enum value to the request property